feat(club-001): club core backend: anonymous members, devices, ledger, cashback config

work/artifacts/CLUB-001/qa.json

@@ -0,0 +1,48 @@
+{
+  "feature_id": "CLUB-001",
+  "agent": "qa",
+  "stage": "qa_gate",
+  "verdict": "APPROVED",
+  "qa_check": "qa",
+  "summary": "QA aprobado: CLUB-001 cubre el alta anónima, persistencia del device token hasheado, lectura de socio/movimientos y settings admin con tests reales e idempotencia del ledger.",
+  "test_results": {
+    "automated": [
+      "./scripts/verify.sh ✅",
+      "cd project && npm run typecheck ✅",
+      "cd project && npm run build ✅",
+      "cd project && npx vitest run src/modules/club/tests/token-and-code.test.ts src/modules/club/tests/boundary.test.ts ✅",
+      "cd project && TEST_DATABASE_URL=postgres://mdv:mdv_dev_only@localhost:5432/mercadodevida_test npx vitest run src/app/tests/club.itest.ts --no-file-parallelism ✅",
+      "git diff --check ✅"
+    ],
+    "coverage": [
+      "GET /club/config",
+      "POST /club/join con creación inicial y reuse por cookie/header",
+      "GET /club/me",
+      "GET /club/movements",
+      "GET/PATCH /admin/club/settings",
+      "idempotencia de club.recordTransaction"
+    ],
+    "manual_smoke_recommended": [
+      "Cuando exista frontend/PWA, comprobar persistencia real de la cookie mdv_club entre navegación y reinstalación en móvil.",
+      "En fases TPV futuras, validar earn/redeem/refund contra el ledger usando la misma idempotencyKey por evento de negocio."
+    ]
+  },
+  "notes": [
+    "La itest muestra un warning de SMTP no configurado durante el registro del admin de prueba; no rompe la suite y viene del flujo de identidad preexistente.",
+    "No se observaron regresiones del harness al revalidar verify.sh después de retomar CLUB-001."
+  ],
+  "evidence": [
+    "work/artifacts/CLUB-001/implementer.md",
+    "work/artifacts/CLUB-001/reviewer.json",
+    "work/artifacts/CLUB-001/security.json",
+    "project/src/app/tests/club.itest.ts",
+    "project/src/modules/club/tests/token-and-code.test.ts",
+    "project/src/modules/club/tests/boundary.test.ts",
+    "./scripts/verify.sh",
+    "cd project && npm run typecheck",
+    "cd project && npm run build",
+    "cd project && TEST_DATABASE_URL=postgres://mdv:mdv_dev_only@localhost:5432/mercadodevida_test npx vitest run src/app/tests/club.itest.ts --no-file-parallelism",
+    "git diff --check"
+  ],
+  "timestamp": "2026-08-26T16:54:20Z"
+}