feat: add new skills for coding standards, continuous learning, detail layout, form layout, project guidelines, security review, and verification loop

- Introduced coding standards for TypeScript and React in SKILL.md.
- Added continuous learning skill with configuration and evaluation scripts.
- Created detail layout guidelines for read-only pages.
- Established form layout rules for data-entry forms.
- Documented project guidelines for the frontend monorepo.
- Implemented security review checklist for frontend/Electron applications.
- Developed a verification loop skill for comprehensive session checks.

This commit enhances the skill set available for developers, ensuring adherence to best practices and improving code quality.

.agents/skills/security-review/SKILL.md

@@ -0,0 +1,85 @@
+---
+name: security-review
+description: Use this skill when adding authentication, handling user input, working with secrets, or touching Electron IPC. Frontend/Electron security checklist for this SPA monorepo.
+---
+
+# Security Review Skill
+
+Client-side security for this React/Electron frontend. There is no NestJS API or SQL layer in this repo.
+
+## When to Activate
+
+- Auth or session handling
+- Forms and user input
+- Secrets / env vars
+- Electron preload / IPC
+- Rendering HTML from the server or users
+
+## Checklist
+
+### 1. Secrets
+
+```typescript
+// NEVER
+const apiKey = "sk-proj-xxxxx"
+
+// ALWAYS
+import { ENV } from '../environment'
+if (!ENV.API_BASE_URL) throw new Error('VITE_API_BASE_URL is not configured')
+```
+
+- [ ] No hardcoded secrets
+- [ ] Env files only under `apps/*/.env*` (`apps/web/.env.example`)
+- [ ] Components use `ENV`, not scattered `import.meta.env`
+- [ ] Treat all `VITE_*` as public
+
+### 2. Input validation
+
+Zod + `@repo/ui/validators` (`compose`, `required`, `rangeLength`) on every form. File uploads: size, MIME, extension allow-lists.
+
+### 3. XSS
+
+- [ ] React text nodes by default
+- [ ] No unsanitized `dangerouslySetInnerHTML`
+- [ ] Sanitize if HTML is required (DOMPurify)
+
+### 4. Auth
+
+- [ ] HTTP only through `apiClient` (`src/core/lib/api-client`)
+- [ ] Session teardown via `terminateAuthSession`
+- [ ] Do not log tokens
+- [ ] Redirect query params encoded
+
+Do not invent httpOnly-cookie APIs this SPA does not own. Token storage follows the existing `auth.helper` + storage adapters.
+
+### 5. Electron (`apps/desktop`)
+
+- [ ] `contextIsolation: true`
+- [ ] `nodeIntegration: false`
+- [ ] `sandbox: true`
+- [ ] No new Node APIs on `window` outside preload
+
+### 6. Sensitive data
+
+- [ ] No tokens or passwords in logs
+- [ ] Generic user-facing errors; details in telemetry only
+
+### 7. Dependencies
+
+```bash
+pnpm audit
+```
+
+- [ ] Lockfile committed
+- [ ] No known high/critical issues without a documented exception
+
+## Out of scope (backend)
+
+Do not spend review time on SQL injection, Drizzle, CSRF-on-API-routes, or API rate limits. Flag them only if this client is clearly bypassing the API contract.
+
+## Resources
+
+- [OWASP Top 10](https://owasp.org/www-project-top-ten/)
+- [Electron security](https://www.electronjs.org/docs/latest/tutorial/security)
+
+**Remember:** One XSS or leaked `VITE_` secret in the client is enough. Prefer the existing `apiClient` and `ENV` wrappers.