feat: add new skills for coding standards, continuous learning, detail layout, form layout, project guidelines, security review, and verification loop

- Introduced coding standards for TypeScript and React in SKILL.md.
- Added continuous learning skill with configuration and evaluation scripts.
- Created detail layout guidelines for read-only pages.
- Established form layout rules for data-entry forms.
- Documented project guidelines for the frontend monorepo.
- Implemented security review checklist for frontend/Electron applications.
- Developed a verification loop skill for comprehensive session checks.

This commit enhances the skill set available for developers, ensuring adherence to best practices and improving code quality.

.cursor/rules/security.mdc

@@ -0,0 +1,57 @@
+---
+description: Mandatory security checks for this SPA/Electron frontend
+alwaysApply: true
+---
+
+# Security Guidelines
+
+## Mandatory Security Checks
+
+Before ANY commit:
+
+- [ ] No hardcoded secrets (API keys, passwords, tokens)
+- [ ] All user inputs validated (Zod + `@repo/ui/validators`)
+- [ ] XSS prevention — React text nodes by default; never unsanitized `dangerouslySetInnerHTML`
+- [ ] Auth tokens only via `src/core/lib/auth.helper` and the shared `apiClient` interceptors
+- [ ] No secrets in client bundles; env files only under `apps/*/.env*`
+- [ ] Error messages shown to users do not leak tokens or stack traces
+
+This is a browser/Electron client. Do not invent SQL injection, CSRF-on-API-endpoints, or API rate-limiting checks here — those belong to the backend.
+
+## Secret Management
+
+```typescript
+// NEVER: Hardcoded secrets
+const apiKey = "sk-proj-xxxxx"
+
+// ALWAYS: App env wrapper (apps/web)
+import { ENV } from '../environment'
+
+if (!ENV.API_BASE_URL) {
+  throw new Error('VITE_API_BASE_URL is not configured')
+}
+```
+
+- Env files: `apps/web/.env*` (see `apps/web/.env.example`). Never at monorepo root.
+- Components read `ENV` from `src/core/environment`, not `import.meta.env` directly.
+- `VITE_*` values are public to the client. Do not put private credentials in Vite env except documented local-dev CouchDB fields.
+
+## Auth and storage
+
+- HTTP: singleton `apiClient` from `src/core/lib/api-client` — never raw axios.
+- Session teardown: `terminateAuthSession` in `auth.helper`.
+- Do not store tokens in source. Do not log access tokens.
+
+## Electron
+
+When touching `apps/desktop/`: keep `contextIsolation: true`, `nodeIntegration: false`, `sandbox: true`. Do not expose Node APIs on `window` outside the existing preload bridge.
+
+## Security Response Protocol
+
+If a security issue is found:
+
+1. STOP immediately
+2. Use **security-reviewer** agent
+3. Fix CRITICAL issues before continuing
+4. Rotate any exposed secrets
+5. Review the rest of the codebase for the same pattern