Reconcile pipeline docs with manual commits made outside the pipeline (Jan 2026)

Checked all 21 manual commits between abde8698 and 147231f (pre-dating
today's takeover) against the newly-built docs/tasks/ and docs/ux-design.md.
Two real conflicts found and fixed:

- Scholarship Aspiration section (task 16-6) was built, then fully removed
  from /about in production (commit e8c1730, 2026-01-11) — task title and
  ux-design.md corrected to say REMOVED, do not re-implement.
- Two-factor authentication was disabled in config/fortify.php at client
  request (commit f8d9133, 2026-01-17) — CLAUDE.md and ux-design.md
  corrected to say the 2FA code path is dormant, not live.

Everything else in that range (copy edits, mail/SMTP fixes, autorefresh bug
fixes, footer brand wording, php-fpm production notes already captured in
CLAUDE.md) doesn't contradict anything in the pipeline docs — no edit needed.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

CLAUDE.md

@@ -123,7 +123,7 @@ Core models in `app/Models/`:
 
 /admin/*              - Admin dashboard (requires admin middleware)
 /client/*             - Client dashboard
-/settings/*           - User settings (profile, password, 2FA, appearance)
+/settings/*           - User settings (profile, password, appearance; 2FA route only registers if the feature is re-enabled, see below)
 ```
 
 ### Middleware
@@ -135,7 +135,10 @@ Core models in `app/Models/`:
 ### Authentication (Fortify)
 All auth is handled via Fortify with custom Volt views. Features enabled:
 - Email verification, Password reset, Profile/password updates
-- Two-factor authentication with QR codes and recovery codes
+- Two-factor authentication (QR codes + recovery codes) is **disabled in production** — commented
+  out in `config/fortify.php` at client request (2026-01-17). `routes/web.php` only registers
+  `settings/two-factor` when `Features::canManageTwoFactorAuthentication()` is true, so the code
+  path still exists but is currently dormant. Don't re-enable without confirming with Naser first.
 - Note: Public registration is disabled; admin creates all client accounts
 
 ### Volt Component Pattern