feat: Add foundational documentation for security, workflow, and project management

- Create SECURITY.md to outline security policies and practices.
- Establish WORKFLOW.md detailing the project lifecycle from planning to retrospective.
- Introduce decision log structure in decisions/README.md for tracking architecture decisions.
- Document Project Manager role with responsibilities, limitations, and operational workflows.
- Implement templates for ADRs, bugs, meetings, projects, retrospectives, RFCs, roadmaps, and sprints.
- Set up memory logs for architecture and company-wide lessons learned.
- Define terminology for consistent understanding across the organization.

ONBOARDING.md

@@ -0,0 +1,74 @@
+# ONBOARDING.md
+
+This is the literal, step-by-step procedure every new AI agent follows before touching Plane,
+Gitea, or a single line of code. If you are an agent that has just been pointed at this
+repository, start here and follow it in order — do not skip ahead to your role's prompt file.
+
+## Step-by-step
+
+```
+1. Read README.md
+        │  What this repo is, what's real vs. planned, how it's organized.
+        ▼
+2. Read COMPANY.md
+        │  Mission, values, philosophy — why things are structured this way.
+        ▼
+3. Read ORGANIZATION.md
+        │  Every role, reporting lines, the org chart. Find your role in it.
+        ▼
+4. Read FOUNDER.md
+        │  Understand the approval gate even if you'll never interact with it directly —
+        │  it explains why work arrives in Plane already-approved.
+        ▼
+5. Read WORKFLOW.md
+        │  The sprint lifecycle end to end. Know where your role's work fits in this chain
+        │  before you start doing any of it.
+        ▼
+6. Read EMPLOYEE_HANDBOOK.md
+        │  Non-negotiable. Escalation, disagreement resolution, confidence reporting,
+        │  never fabricating results, never marking work done without verification.
+        ▼
+7. Read CODING_STANDARDS.md and SECURITY.md
+        │  Required even for non-engineering roles — everyone reviews or is reviewed
+        │  against these.
+        ▼
+8. Read your role folder: employees/<your-role>/
+        │  README.md → ROLE.md → RESPONSIBILITIES.md → LIMITATIONS.md → WORKFLOW.md
+        │  → PROMPT.md → MEMORY.md → SUCCESS_METRICS.md, in that order.
+        ▼
+9. Read PLANE.md and GITEA.md
+        │  Exactly how to interact with the two systems you'll touch daily.
+        │  (If Plane is not yet deployed, note that and proceed — GITEA.md still applies.)
+        ▼
+10. Connect to Gitea
+        │  Confirm your Git identity, SSH key, and account exist per GITEA.md. If they
+        │  don't exist yet, that's a DevOps task, not something to work around.
+        ▼
+11. Connect to Plane (once deployed)
+        │  Confirm your Plane account and current sprint assignment.
+        ▼
+12. Load your current project
+        │  Read projects/<project-name>/ — its PROJECT.md and any ADRs referenced from
+        │  decisions/ that apply to it.
+        ▼
+13. Begin work
+        │  Claim a task per WORKFLOW.md. Not before this point.
+```
+
+## Non-negotiable checkpoints
+
+Before step 13, you must be able to answer all of the following. If you can't, go back — don't
+proceed and figure it out later:
+
+- What is my role's one job, and what is explicitly *not* my job (`LIMITATIONS.md`)?
+- Who do I escalate to, for a technical question vs. a priority question?
+- What does "done" mean for a task in my role, and who verifies it?
+- What am I never allowed to do without explicit approval (see the relevant policy doc:
+  `SECURITY.md`, `GITEA.md`, or your role's `LIMITATIONS.md`)?
+
+## For the agent onboarding the very first employee role
+
+If `employees/<role>/` doesn't exist yet for your assigned role, do not invent it ad hoc. Use
+`employees/project-manager/` as the reference pattern — it's the first role built out fully in
+this repository specifically to serve as a template. Match its structure (all eight files),
+adapt its content to your role, and don't ship a role folder with placeholder files.