- Allow draft reports to be saved without patient name or hospital ID while keeping completed reports strictly validated.
- Preserve completed-report identity validation when updating existing reports by checking merged old and new values.
- Show real API save errors in the report editor and send expired sessions back to login instead of reporting a generic backend outage.
- Guard speech startup for missing getUserMedia or AudioContext support and explain localhost/HTTPS microphone requirements.
- Add report schema tests covering draft identity fields and completed-report validation.
- Update AGENTS and docs for report editor behavior, feature status, progress, and testing coverage.
- Align the backend seeded default surgery template with the report editor's default report content.
- Add backend demo defaults for the default template, Kimi provider, and Xunfei speech proxy configuration.
- Change system reset into a super-admin demo mode factory reset that clears reports, audit logs, files, custom templates, and non-default users.
- Keep only the default admin, manager, doctor, and default surgery template after demo reset.
- Replace the old local-only reset all data button with a two-confirmation backend reset flow.
- Add tests covering demo default alignment and database-backed demo reset behavior.
- Update docs to describe demo mode reset semantics and production credential cautions.
- Add docs/component-structure.md covering the current React component hierarchy, page routes, public components, API/Auth/Utils boundaries, and data flow.
- Document the internal responsibilities and split risks for large pages including ReportEditor and TemplateManage.
- Link the new component structure guide from README, docs index, AGENTS file tree, and progress notes.
- Add docs/installation.md covering prerequisites, port usage, Docker startup, local development setup, default accounts, first-run validation, and common setup issues.
- Link the installation guide from the project README and docs index.
- Point deployment documentation to the installation guide for first-time setup.
- Update AGENTS.md and progress documentation to include the new installation guide.
- Remove the super-admin one-time migration from browser local settings into backend AI and speech settings.
- Delete the migration-specific SystemSettings unit test that no longer matches the desired behavior.
- Restore feature, module, testing, and progress docs so settings secrets are documented as backend-managed only.
- Add a super-admin-only settings merge that copies legacy local AI provider keys into an empty backend settings record.
- Add matching migration for legacy Xunfei APPID, APIKey, and APISecret without overwriting existing backend secrets.
- Cover the migration and secret-preservation behavior with SystemSettings unit tests.
- Update feature, module, progress, and testing docs for the settings migration behavior.
- Change the API default listen port from 3000 to 3100 and include the Docker frontend origin in default CORS.
- Point Vite's default API proxy, Docker API container port, and Nginx upstream to 3100.
- Keep Docker host ports on 4002 for web, 3002 for API, and 5433 for PostgreSQL.
- Update environment examples and documentation to remove stale localhost:3000 guidance.
- Add Auth Context route role guards so doctors cannot directly enter template management, user management, or audit logs.
- Add Audit Logs page, sidebar entry, frontend audit API client, and API client test.
- Add backend audit log query endpoint with super/admin visibility rules and query filtering.
- Extend PostgreSQL integration tests to cover audit log query permissions.
- Move Playwright E2E away from localStorage seed data to real backend API login and seed helpers.
- Add E2E coverage for route guards and audit log visibility.
- Run Playwright backend on port 3100 and proxy Vite API requests there to avoid local port conflicts.
- Make server:dev use the compiled NestJS server path, avoiding tsx parameter-property injection issues.
- Update README, AGENTS, feature, testing, security, deployment, progress, API, backendization, and auth/user module docs.
- Mark the user signature upload API as implemented in the backendization plan.
- Refresh the progress next-step list to focus on remaining E2E seed migration, fallback cleanup, audit visibility, export API, rate limits, data migration, and production operations.
