docs: architecture, toolchain, resume highlights; AGENTS.md points to them

docs/RESUME-HIGHLIGHTS.md

@@ -0,0 +1,25 @@
+# Where Woof — Project Highlights (resume-ready)
+
+A production return-item tag platform built end-to-end on a home-lab stack, from spec to live deployment.
+
+## What it is
+A SaaS-style product: physical QR/NFC tags for pets/luggage; a finder scans → sees return details → the owner is alerted by SMS with the finder's location. Includes a full admin dashboard for users, tags, products and orders.
+
+## What I built (the pipeline)
+1. **Spec-driven development** — OpenSpec: every feature went through proposal → design → specs (testable requirements) → tasks, validated, and tracked through the whole project.
+2. **Public web app (Go)** — "GOAT" stack: Go stdlib + HTMX + Alpine.js + Tailwind + Postgres. Auth, tag registry (anti-scam), scan flow with geolocation, location-aware SMS throttling, browser-fingerprint anti-spam, photo uploads.
+3. **Admin app (Laravel + Filament)** — CRUD for users/tags/products/orders, dashboard stats, admin auth gating — against the **same** shared Postgres.
+4. **Real SMS integration** — SMSGlobal HTTP API (verified sender), with a swappable sender abstraction and a log-mode fake for testing.
+5. **Deployment** — Go binary as a systemd service, Laravel in Docker, Caddy reverse proxy with automatic TLS, DNS migration off legacy hosting, internal DNS (Pi-hole), firewall management on NixOS.
+6. **AI-assisted engineering workflow** — used the pi coding agent with subagent delegation (database/coder/review agents), plan review tooling, memory/runbooks, and regression test suites (53 HTTP-level checks).
+
+## Stack highlights
+Go 1.26 · HTMX · Alpine.js · Tailwind · PostgreSQL 16 · sqlc (type-safe SQL) · Laravel 13 · Filament v3 · Docker · NixOS · systemd · Caddy · Gitea · SMSGlobal API · OpenSpec · pi/agent tooling
+
+## Things I'm proud of / learned
+- Decrypted a legacy AES-256-ECB product-ID scheme (100 encrypted sequential IDs recovered and re-seeded as a tamper-proof registry).
+- Debugged and fixed production-only issues: Filament's 403-after-login (model must implement `FilamentUser`), mixed-content asset blocking behind a reverse proxy, and a Caddy config crash from duplicate site blocks.
+- Rebuilt my own 2014-era product design (its comments anticipated distance throttling and fingerprint anti-spam) with modern tooling.
+
+## Where it runs
+Live on `where-woof.com` and `admin.where-woof.com` — home-lab infra: desktop (.27, dev) → server (.13, prod) → Caddy box (.35), one shared Postgres.