create mvp path

.claude/skills/flow-testing/SKILL.md

@@ -10,14 +10,14 @@ description: >-
 
 Exercising a flow proves something only if you know which half of the stack actually answered. This is the
 procedure; the facts it points at (ports, accounts, known failure modes) live in
-[docs/flows/testing-setup.md](../../../docs/flows/testing-setup.md) and are kept current there — don't copy
+[docs/flows/testing-setup.md](../../../archive/docs/flows/testing-setup.md) and are kept current there — don't copy
 them here, they will drift.
 
 ---
 
 ## 1. Boot it
 
-The five-minute path, verbatim from [testing-setup.md](../../../docs/flows/testing-setup.md#the-five-minute-path):
+The five-minute path, verbatim from [testing-setup.md](../../../archive/docs/flows/testing-setup.md#the-five-minute-path):
 
 ```bash
 # API — mock SMS or request_otp 500s
@@ -41,7 +41,7 @@ carries a `Last verified` stamp for exactly this reason.
 
 A flow "working" through a mocked domain proves the UI, not the server. Before testing:
 
-1. Open [docs/integration/domains/index.md](../../../docs/integration/domains/index.md) — the census table
+1. Open [docs/integration/domains/index.md](../../../archive/docs/integration/domains/index.md) — the census table
    names which of the 22 client `services/` domains are real vs **mock** (currently 15 real, 7 mock:
    `admin`, `bnpl`, `partnerCenter`, `patientRecords`, `payouts`, `refunds`, `verification`).
 2. A mocked domain is a `USE_<DOMAIN>_MOCK` flag in `client/src/services/<domain>/constants.ts` — check it
@@ -55,7 +55,7 @@ A flow "working" through a mocked domain proves the UI, not the server. Before t
 ## 3. Pick the right seeded account
 
 Demo accounts, their roles, and what each one demonstrates are tabulated in
-[testing-setup.md](../../../docs/flows/testing-setup.md#demo-accounts) — read it there rather than assuming
+[testing-setup.md](../../../archive/docs/flows/testing-setup.md#demo-accounts) — read it there rather than assuming
 a phone number. One standing gap to route around: **the seeded admin accounts (`…020` `super_admin`,
 `…021` `finance`) get 403 on every real admin endpoint** (a `DynamicPermission` / role-literal mismatch).
 The admin backoffice is only testable against the client's mock; don't spend time trying to walk it against
@@ -65,7 +65,7 @@ the real API without first checking whether that gap has been closed.
 
 ## 4. Walk the flow
 
-[docs/flows/index.md](../../../docs/flows/index.md) is the atlas — one file per user-meaningful journey,
+[docs/flows/index.md](../../../archive/docs/flows/index.md) is the atlas — one file per user-meaningful journey,
 each answering exactly three questions: what it does, what's mocked *for that journey specifically*, and how
 to test it. Open the one file that matches what you're testing rather than guessing the steps; it's the
 one place gap numbers and REQ references for that journey are tracked.
@@ -79,7 +79,7 @@ one place gap numbers and REQ references for that journey are tracked.
   on a request promptly, or create a fresh one rather than trying to reuse an old test artifact.
 - **The OTP endpoints are rate-limited together.** `request_otp` and `verify_otp` share one bucket, 5 calls
   per 60 s per IP — a login is 2 calls, so that's **two logins per minute, total**. Space scripted logins
-  ≥ 40 s apart (see [testing-setup.md](../../../docs/flows/testing-setup.md#scripting-logins) for a working
+  ≥ 40 s apart (see [testing-setup.md](../../../archive/docs/flows/testing-setup.md#scripting-logins) for a working
   script) or you'll 429 and misread it as a bug.
 
 ---
@@ -102,6 +102,6 @@ because the world was seeded days ago:
 
 Name the account you used, the domain's mock/real status, and the exact response (status code, error
 message) rather than "it worked" — the troubleshooting table in
-[testing-setup.md](../../../docs/flows/testing-setup.md#troubleshooting) exists because several failure
+[testing-setup.md](../../../archive/docs/flows/testing-setup.md#troubleshooting) exists because several failure
 modes here look identical to an unrelated bug (a rate limit looks like a crash; `/healthz/ready` failing on
 Windows looks like the app is down). Check it before filing something as a new defect.