docs: map existing codebase

- stack.md (68 lines) - PHP/MySQL/Apache stack, vendored libraries
- architecture.md (131 lines) - Custom MVC CMS, dual-layer (front/admin)
- structure.md (170 lines) - Directory layout and conventions
- conventions.md (98 lines) - PHP snake_case, SCSS $c/$f prefixes, jQuery patterns
- testing.md (49 lines) - No automated tests detected
- integrations.md (111 lines) - Google Maps, PHPMailer, Pixieset, Facebook
- concerns.md (150 lines) - Critical security issues: hardcoded creds, MD5, unserialize
- db_schema.md (260 lines) - ~32 tables with pp_ prefix, inferred from source
- tech_changelog.md (9 lines) - Initial log entry

Co-Authored-By: Claude <noreply@anthropic.com>

.paul/codebase/testing.md

@@ -0,0 +1,71 @@
+# Testing Patterns
+
+**Analysis Date:** 2026-05-05
+
+## Test Framework
+
+**Runner:**
+- None detected — no test runner configured
+
+**Assertion Library:**
+- None
+
+**Run Commands:**
+- No test commands available in project
+
+## Test File Organization
+
+**Location:**
+- No test files found in codebase (searched for `*.test.js`, `*.spec.js`, `*Test.php`, `__tests__/`)
+
+**Naming:**
+- No test naming convention (no tests exist)
+
+## Test Infrastructure
+
+**PHPUnit:**
+- Not installed — no `phpunit.xml`, no `vendor/phpunit`
+
+**Jest / Vitest:**
+- Not installed — no `package.json`, no test config
+
+**Coverage Tools:**
+- None configured
+
+**Linting/Static Analysis:**
+- No ESLint (no `.eslintrc`)
+- No Prettier (no `.prettierrc`)
+- No PHP CodeSniffer (no `phpcs.xml`)
+- No StyleLint
+
+## Testing Approach
+
+**Current state:**
+- Manual testing only — no automated test infrastructure
+- No CI/CD pipeline to run tests
+- No test directories anywhere in the project
+
+**Quality assurance:**
+- Live Sass Compiler (`admin/css/custom.scss`) — validates SCSS syntax at compile time
+- FTP deployment via VS Code extension — direct push to production/staging server
+- Browser-based manual verification
+
+## Recommendations (if implementing tests)
+
+**PHP — PHPUnit:**
+- Target the factory layer: `autoload/admin/factory/class.*.php`, `autoload/front/factory/class.*.php`
+- These are static methods — use PHPUnit with Medoo mocking
+
+**JavaScript — Jest or Playwright:**
+- Frontend forms and gallery interactions
+- Admin grid operations
+
+**Priority areas to test first (given security concerns):**
+1. Input sanitization in `autoload/class.S.php` (the `get()` method)
+2. File upload validation in `plugins/special-actions-middle.php`
+3. Authentication flow in `admin/index.php`
+
+---
+
+*Testing analysis: 2026-05-05*
+*Update when test patterns are introduced*