Prepare project for pipeline takeover: task tracker, UX doc, CLAUDE.md pointers

Adds docs/tasks/ (16 epics + 102 stories converted to task/subtask files with
statuses.md as the new status source of truth) and docs/ux-design.md
(retrospective design-system reference), and points CLAUDE.md at them.
docs/prd.md and docs/architecture.md are kept as BMAD wrote them; the legacy
docs/stories/, docs/epics/, docs/qa/gates/ and .bmad-core/ stay in place as
historical/traceability records, superseded but not deleted.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

docs/tasks/1-2.md

@@ -0,0 +1,35 @@
+---
+id: 1-2
+title: 1-2 Authentication & Role System
+status: Done
+date: 2026-09-27
+parent: 1
+---
+
+## Description
+
+As an admin, I want a secure authentication system with Admin/Client roles, So that only authorized users can access the platform with appropriate permissions. Full implementation history: docs/stories/story-1.2-authentication-role-system.md
+
+## Acceptance Criteria
+
+- [ ] Fortify configured with custom Volt views
+- [ ] Login page with bilingual support (Arabic/English)
+- [ ] Session timeout after 2 hours of inactivity
+- [ ] Rate limiting on login attempts (5 attempts per minute)
+- [ ] Admin role with full access to all features
+- [ ] Client role with restricted access (own data only)
+- [ ] Registration feature DISABLED (admin creates all accounts)
+- [ ] CSRF protection enabled on all forms
+- [ ] Password hashing using bcrypt
+- [ ] Custom middleware for admin authorization
+- [ ] Secure session configuration
+- [ ] Remember me functionality (optional)
+- [ ] Login redirects to appropriate dashboard:
+- [ ] Logout clears session properly and redirects to login page
+- [ ] Admin middleware protects admin-only routes (return 403 for unauthorized)
+- [ ] Failed login attempts logged to `admin_logs` table
+- [ ] Deactivated users cannot log in
+- [ ] Login form validates inputs properly
+- [ ] Error messages are clear and bilingual
+- [ ] All test scenarios in "Testing" section pass
+- [ ] No security vulnerabilities