PR #1 implements the instruction policy tracked by mobile issue #996.

Agents must read .agents/rules/backend-authority.mdc through AGENTS.md, CLAUDE.md and the Claude adapter. The backend exclusively owns business rules, decisions, calculations, validation and domain state, including scan identification/results, catalogue metadata and asset associations, pricing, collections, quotas and admission. Frontends render supplied data/assets and submit commands. Their only local state is for presentation and transport, never business authority.

Historical client-side business logic must be identified as migration work; it is not grandfathered in by these rules. This change documents the required architecture and does not claim the existing application has already been migrated.

Validation: the four repository policy bodies match, all twelve loader references resolve, the rule is not excluded by Git, and whitespace checks pass. These are documentation/configuration changes; runtime tests are not applicable. PR prepared against staging, not merged or deployed.