- Change the API default listen port from 3000 to 3100 and include the Docker frontend origin in default CORS.
- Point Vite's default API proxy, Docker API container port, and Nginx upstream to 3100.
- Keep Docker host ports on 4002 for web, 3002 for API, and 5433 for PostgreSQL.
- Update environment examples and documentation to remove stale localhost:3000 guidance.
- Add Auth Context route role guards so doctors cannot directly enter template management, user management, or audit logs.
- Add Audit Logs page, sidebar entry, frontend audit API client, and API client test.
- Add backend audit log query endpoint with super/admin visibility rules and query filtering.
- Extend PostgreSQL integration tests to cover audit log query permissions.
- Move Playwright E2E away from localStorage seed data to real backend API login and seed helpers.
- Add E2E coverage for route guards and audit log visibility.
- Run Playwright backend on port 3100 and proxy Vite API requests there to avoid local port conflicts.
- Make server:dev use the compiled NestJS server path, avoiding tsx parameter-property injection issues.
- Update README, AGENTS, feature, testing, security, deployment, progress, API, backendization, and auth/user module docs.
- Mark the user signature upload API as implemented in the backendization plan.
- Refresh the progress next-step list to focus on remaining E2E seed migration, fallback cleanup, audit visibility, export API, rate limits, data migration, and production operations.
