docs: map existing codebase

- stack.md - Technologies and dependencies
- architecture.md - System design and patterns
- structure.md - Directory layout
- conventions.md - Code style and patterns
- testing.md - Test structure (none)
- integrations.md - External services
- concerns.md - Technical debt and issues
- db_schema.md - Database schema and relationships

Co-Authored-By: Claude <noreply@anthropic.com>

.paul/codebase/testing.md

@@ -0,0 +1,55 @@
+# Testing
+
+**Analysis Date:** 2026-04-26
+
+## Framework
+
+**No automated test framework detected.**
+
+- No PHPUnit, PHPSpec, Codeception, or Behat
+- No Composer (so no dev dependencies at all)
+- No `package.json` or Node.js test tooling
+
+## Structure
+
+**No test directories or test files found:**
+- No `tests/`, `test/`, `__tests__/` directories
+- No files matching `*.test.php`, `*Test.php`, `*Spec.php`
+- No `phpunit.xml`, `phpunit.xml.dist`, or similar config
+
+## Coverage
+
+**Zero automated test coverage.**
+
+All validation is runtime-only:
+- IP-based session security in `index.php` and `ajax.php` (security guard, not tests)
+- Manual payment flow testing via Przelewy24 sandbox mode (`$settings['p24_sandbox']`)
+- Test price mode: `test_price_mode_on()` sets all ticket prices to 1 PLN via secret key (`autoload/controls/class.Tickets.php`)
+
+## Tools
+
+**None configured:**
+- No Xdebug or pcov for coverage
+- No CI/CD (no `.github/workflows/`, no `.travis.yml`, no `bitbucket-pipelines.yml`)
+- No static analysis (PHPStan, Psalm)
+- No linting tools
+
+## Testing Approach in Practice
+
+This is a legacy production system with manual testing only:
+1. Developer makes changes and uploads via FTP
+2. Tests manually in browser against live or sandbox payment mode
+3. Przelewy24 sandbox available for payment flow testing
+4. No regression protection
+
+## Recommendations
+
+If adding tests in future:
+- PHPUnit for factory/service layer unit tests (no framework dependency to work around)
+- Focus first on `autoload/factory/class.Tickets.php` — calendar logic, basket calculations
+- Integration tests for payment webhook handler (`przelewy24_response()`)
+- Bootstrap challenge: globals (`$mdb`, `$settings`) need to be injectable for testability
+
+---
+
+*Testing analysis: 2026-04-26*