chore: seal Design Vision v1 and monorepo scaffold

Archive the differentiated YuXinGu product docs, AI engineering system,
design contract, and Go/Vue scaffold. Next execution prioritizes Cece-parity
over early innovation (see .ai/product/STRATEGY.md).

Co-authored-by: Cursor <cursoragent@cursor.com>

.ai/playbooks/add-api.md

@@ -0,0 +1,19 @@
+# Playbook: Add API
+
+Use when: “新增xxx接口”
+
+## Steps
+
+1. **OpenAPI** — add path to `proto/openapi.yaml`
+2. **Migration** — if new/changed table (`apps/api/migrations/`)
+3. **Model** — `internal/model`
+4. **Repository** — SQL only
+5. **Service** — business + authz
+6. **Handler** — bind + envelope; interface at handler
+7. **Wire** — register route in `cmd/server` or router file
+8. **Test** — at least service/engine unit test if logic-heavy
+9. **SDK/types** — update `packages/sdk` + `packages/types` if clients need it
+10. **Commands** — `go test ./...`, hit with curl
+11. **Review + DoD + checklist/feature.md**
+
+Follow patterns: `handler.md` `service.md` `repository.md` `pagination.md`.

.ai/playbooks/login.md

@@ -0,0 +1,14 @@
+# Playbook: Login / Auth
+
+## Steps
+
+1. Cite ADR-0004
+2. Define Visitor vs User in API behavior (`.ai/domain.md`)
+3. Issue Bearer token; document in OpenAPI
+4. Middleware extracts `user_id`
+5. Persist session/user as designed (Postgres MVP; Redis deferred)
+6. H5: store token via adapter (`localStorage` key `yxg_token`)
+7. SDK `getToken` wired
+8. Tests: invalid token / expired / ownership
+9. Security review checklist
+10. Never accept `X-User-Id` alone as auth

.ai/playbooks/new-page.md

@@ -0,0 +1,18 @@
+# Playbook: New H5 Page
+
+Use when: “新增页面”
+
+## Steps
+
+1. Confirm IA tab vs secondary page (`.ai/ui.md`)
+2. Read `.ai/design/design-system.md` + `component-catalog.md` + `design/platform/h5.md`
+3. Reuse catalog components; update catalog if adding a new one
+4. Add route in `apps/user-h5/src/router`
+5. Add `pages/XxxPage.vue` (PascalCase); tokens only (no raw brand hex)
+6. Extract components if file approaches 300–400 lines
+7. Data via `src/api` → `@yuxingu/sdk` only
+8. Use domain words from `.ai/domain.md`
+9. Loading / empty / error states
+10. Compliance copy if report-like
+11. `npm run build:h5`
+12. Review + checklist/feature.md

.ai/playbooks/new-table.md

@@ -0,0 +1,14 @@
+# Playbook: New Table
+
+Use when: “新建表 / 加字段”
+
+## Steps
+
+1. Name with `snake_case` (`.ai/database.md` + `.ai/domain.md`)
+2. Columns include `id, created_at, updated_at, deleted_at`
+3. Write migration Up (+ Down)
+4. Index FKs
+5. Update `model` + repository
+6. Never ship app code that queries columns not migrated
+7. Document in PR
+8. Review (Deployment + Docs items)

.ai/playbooks/payment.md

@@ -0,0 +1,14 @@
+# Playbook: Payment / Unlock / Subscription
+
+## Steps
+
+1. Terms: Order, Payment, Unlock, Subscription, Membership, VIP (`.ai/domain.md`)
+2. Server creates Order with amount/currency/product ref
+3. Client never sets final price unilaterally
+4. Payment callback verifies signature + idempotency
+5. On success: grant Membership or Unlock in service transaction
+6. Report access checks Membership/Unlock server-side every time
+7. Migration for `payment_order` / related tables
+8. Tests: double callback, wrong amount, replay
+9. No secrets in frontend
+10. Feature checklist + security review