Migrate project artifacts to spec-kit format

- Move cross-cutting docs (personas, design system, implementation phases,
  Ideen.md) to .specify/memory/
- Move cross-cutting research and plans to .specify/memory/research/ and
  .specify/memory/plans/
- Extract 5 setup tasks from spec/setup-tasks.md into individual
  specs/001-005/spec.md files with spec-kit template format
- Extract 20 user stories from spec/userstories.md into individual
  specs/006-026/spec.md files with spec-kit template format
- Relocate feature-specific research and plan docs into specs/[feature]/
- Add spec-kit constitution, templates, scripts, and slash commands
- Slim down CLAUDE.md to Claude-Code-specific config, delegate principles
  to .specify/memory/constitution.md
- Update ralph.sh with stream-json output and per-iteration logging
- Delete old spec/ and docs/agents/ directories
- Gitignore Ralph iteration JSONL logs

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

specs/017-qr-code/spec.md

@@ -0,0 +1,60 @@
+# Feature Specification: Generate a QR Code for an Event
+
+**Feature**: `017-qr-code`
+**Created**: 2026-03-06
+**Status**: Draft
+**Source**: Migrated from spec/userstories.md
+
+## User Scenarios & Testing
+
+### User Story 1 - Display and Download QR Code (Priority: P1)
+
+Any visitor who holds the event link can view a QR code on the event page that encodes the public event URL. The QR code is generated server-side — no external service is contacted — and can be downloaded as a print-ready file (SVG or high-resolution PNG). This makes it easy to print the code on posters or flyers.
+
+**Why this priority**: This is the core deliverable of US-11. Without a downloadable, server-generated QR code, the feature has no value. All other criteria are conditions of this baseline.
+
+**Independent Test**: Can be fully tested by loading any event page and verifying that a QR code is displayed, that a download link produces a valid SVG or PNG file whose content encodes the correct event URL, and that no external network request was made to generate it.
+
+**Acceptance Scenarios**:
+
+1. **Given** a valid event exists, **When** a visitor opens the event page, **Then** a QR code encoding the public event URL is displayed on the page.
+2. **Given** a QR code is displayed, **When** the visitor clicks the download link, **Then** a file (SVG or high-resolution PNG) is downloaded directly from the app's backend without client-side generation.
+3. **Given** the downloaded file, **When** it is scanned with a QR reader, **Then** it resolves to the correct public event URL.
+4. **Given** the QR code endpoint is accessed, **When** the server generates the code, **Then** no request is made to any external QR code service.
+5. **Given** a visitor who has not RSVPed or logged in, **When** they access the event page, **Then** the QR code and download link are still available — no organizer token or RSVP required.
+6. **Given** the event has expired, **When** a visitor opens the event page, **Then** the QR code and download link remain available and functional.
+7. **Given** the QR code download is requested, **When** the server handles the request, **Then** no personal data, IP address, or identifier is transmitted to any third party.
+
+---
+
+### Edge Cases
+
+- What happens when the event does not exist? The server returns "event not found" — the QR code endpoint must behave consistently and not leak data.
+- How does the download link behave when the event URL is long? The QR code must be generated at sufficient error-correction level to remain scannable even for longer URLs.
+
+## Requirements
+
+### Functional Requirements
+
+- **FR-001**: The event page MUST display a QR code that encodes the public event URL.
+- **FR-002**: The QR code MUST be generated entirely server-side — no external QR code service or third-party API may be contacted.
+- **FR-003**: The QR code MUST be downloadable as a file suitable for printing (SVG or high-resolution PNG).
+- **FR-004**: The QR code download MUST be served from a direct backend endpoint — the actual file download MUST NOT require client-side generation.
+- **FR-005**: The QR code MUST be accessible to any visitor holding the event link; no organizer token or RSVP is required.
+- **FR-006**: No personal data, IP address, or identifier MUST be transmitted to any third party when the QR code is generated or downloaded.
+- **FR-007**: The QR code MUST remain available and downloadable after the event has expired.
+- **FR-008**: The QR code endpoint MUST return a consistent "event not found" response if the event does not exist — no partial data or error traces may be exposed.
+
+### Key Entities
+
+- **QRCode**: Virtual — no independent storage. Generated on demand from the event token and the public event URL. Not persisted.
+
+## Success Criteria
+
+### Measurable Outcomes
+
+- **SC-001**: A visitor can view a QR code on any event page without performing any additional action (no login, no RSVP).
+- **SC-002**: The downloaded file scans correctly to the event URL in at least two independent QR reader applications.
+- **SC-003**: No outbound network request to an external service is made during QR code generation (verifiable via network inspection).
+- **SC-004**: The QR code endpoint returns a valid file for both active and expired events.
+- **SC-005**: The download link works without JavaScript (direct server endpoint).