chore(tooling): editorconfig, CODEOWNERS, jsdom component tests, knip

.editorconfig

@@ -0,0 +1,24 @@
+# EditorConfig — https://editorconfig.org
+# Keeps editor defaults in lockstep with .prettierrc (printWidth 120, 2-space)
+# and .gitattributes (`* text=auto eol=lf`). Editor-only; formatting is still
+# enforced by Prettier — this just stops editors introducing CRLF / tab / stray
+# trailing-whitespace churn before Prettier runs.
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+insert_final_newline = true
+trim_trailing_whitespace = true
+indent_style = space
+indent_size = 2
+
+# Markdown: two trailing spaces are a meaningful hard line break, so do not strip them.
+[*.md]
+trim_trailing_whitespace = false
+
+# Generated by `supabase gen types`; keep the generator's formatting (also
+# prettier-ignored in .prettierignore) so regeneration stays churn-free.
+[src/lib/supabase/database.types.ts]
+trim_trailing_whitespace = false
+insert_final_newline = false

.github/CODEOWNERS

@@ -0,0 +1,39 @@
+# CODEOWNERS — https://docs.github.com/articles/about-code-owners
+#
+# This repo is currently single-maintainer, so every path resolves to the same
+# owner. The value here is intent + automatic review routing on the high-risk
+# surfaces called out in AGENTS.md (auth, migrations/RLS, RAG/retrieval, source
+# governance, clinical output, production config). As collaborators join, add
+# them to the specific sections below rather than only the catch-all.
+#
+# Later patterns win, so the catch-all comes first and high-risk paths override it.
+
+# Catch-all
+*                                   @BigSimmo
+
+# Database / migrations / RLS (destructive-change surface)
+/supabase/                          @BigSimmo
+
+# Environment + security header contract
+/src/lib/env.ts                     @BigSimmo
+/src/lib/client-env.ts              @BigSimmo
+/src/lib/security-headers.ts        @BigSimmo
+/src/proxy.ts                       @BigSimmo
+/src/instrumentation.ts             @BigSimmo
+/src/instrumentation-client.ts      @BigSimmo
+
+# RAG / retrieval / search / ranking
+/src/lib/rag.ts                     @BigSimmo
+/src/lib/rag-*.ts                   @BigSimmo
+/src/lib/retrieval-*.ts             @BigSimmo
+/src/lib/*search*.ts                @BigSimmo
+/src/lib/privacy.ts                 @BigSimmo
+/src/lib/query-privacy.ts           @BigSimmo
+
+# Source governance + clinical output
+/scripts/audit-source-governance.ts @BigSimmo
+/scripts/*governance*.ts            @BigSimmo
+/docs/clinical-governance.md        @BigSimmo
+
+# CI / release automation
+/.github/workflows/                 @BigSimmo

knip.json

@@ -0,0 +1,20 @@
+{
+  "$schema": "https://unpkg.com/knip@6/schema.json",
+  "entry": [
+    "src/instrumentation.ts",
+    "src/instrumentation-client.ts",
+    "src/proxy.ts",
+    "scripts/**/*.{ts,mjs,cjs}",
+    "worker/**/*.ts",
+    "playwright/**/*.ts",
+    "eslint-rules/**/*.mjs",
+    "tests/**/*.{test.ts,dom.test.tsx,spec.ts}",
+    "*.config.{ts,mts,mjs,cjs}"
+  ],
+  "project": ["src/**/*.{ts,tsx}", "scripts/**/*.{ts,mjs,cjs}", "worker/**/*.ts", "eslint-rules/**/*.mjs"],
+  "ignore": ["src/lib/supabase/database.types.ts", "**/*mockup*", "src/app/mockups/**", "supabase/functions/**"],
+  "ignoreDependencies": ["tailwindcss", "server-only"],
+  "ignoreBinaries": ["supabase", "semgrep", "gitleaks", "taskkill"],
+  "vitest": { "config": ["vitest.config.mts"] },
+  "playwright": { "config": ["playwright.config.ts", "playwright.visual.config.ts"] }
+}