Repo hygiene: gate /mockups out of production, CI audit gate, untrack scratch, archive stale docs

.env.example

@@ -77,6 +77,9 @@ RAG_AWAIT_QUERY_LOGS=false
 # Privacy / production safety
 # Explicit demo opt-in. Blocked by npm run check:production-readiness in production.
 #NEXT_PUBLIC_DEMO_MODE=false
+# Design-exploration mockup routes (/mockups/*) 404 in production builds unless
+# explicitly opted in. Always reachable in dev/test.
+#NEXT_PUBLIC_MOCKUPS_ENABLED=false
 # Persist raw clinical query text in logs. Default off; blocked in production readiness.
 #RAG_PERSIST_RAW_QUERY_TEXT=false
 # Server-side key for the redacted query-hash placeholder (min 16 chars).

.github/workflows/ci.yml

@@ -52,6 +52,12 @@ jobs:
       - name: Runtime alignment
         run: npm run check:runtime
 
+      - name: Dependency vulnerability audit
+        # Non-mutating gate. The document parsers (pdf-parse, pdfjs-dist, mammoth,
+        # exceljs, jszip) process untrusted uploads, so high/critical advisories in
+        # the production tree must block the merge rather than wait for Dependabot.
+        run: npm audit --omit=dev --audit-level=high
+
       - name: Edge function typecheck
         run: npm run check:edge:functions
 

.gitignore

@@ -79,5 +79,7 @@ artifacts/
 # Local debugging scratch space — never commit (accidentally landed once via 'Save Codex local changes')
 scratch/
 .qa-smoke/
+# Visual-QA capture scratch (scripts + screenshots) — untracked 2026-07-06 after 24 files landed
+.tmp-visual/
 *.pid
 tmp_output.txt