Add User model tests, technical debt tracking, and bug fix protocol

Improvements:
1. Added 15 comprehensive User model unit tests
2. Created TECHNICAL_DEBT.md to track test gaps and known issues
3. Updated constitution with Bug Fix Protocol (v1.1.0)

User Model Tests (tests/unit/test_user_model.py):
- Test user creation and properties
- Test is_active property (Flask-Login integration)
- Test password hashing and verification
- Test serialization (to_dict/from_dict)
- Test CRUD operations (create, load, update, delete)
- Test error conditions (duplicate username, invalid role)

Technical Debt Documentation (docs/TECHNICAL_DEBT.md):
- Missing authentication route tests
- CSRF testing disabled by design
- Dashboard routes not implemented (planned)
- ClamAV integration not fully tested
- All 3 MVP bugs documented with lessons learned

Constitution Amendment (v1.0.0 → v1.1.0):
- Added Bug Fix Protocol requiring:
  - Write failing test before fix
  - Document in TECHNICAL_DEBT.md
  - Commit test and fix together
  - Lessons learned capture

Test Coverage Improvement:
- Before: 10 tests (8 contract + 2 integration)
- After: 26 tests (8 contract + 2 integration + 15 unit + 1 skipped)
- User model: 0% → 100% coverage

Rationale: Bugs found during manual testing revealed insufficient
test coverage. This addresses the gap and establishes process to
prevent future coverage deficiencies.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

.specify/memory/constitution.md

@@ -106,6 +106,30 @@ Documentation MUST live alongside code, be version-controlled, and follow the sa
 5. **Implement** (`/speckit.implement`): Execute tasks following test-first discipline
 6. **Analyze** (`/speckit.analyze`): Verify cross-artifact consistency
 
+### Bug Fix Protocol
+
+Every bug fix MUST follow this protocol:
+
+1. **Write a Failing Test**: Create a test that reproduces the bug and currently fails
+2. **Verify Failure**: Run the test to confirm it fails with the buggy code
+3. **Fix the Bug**: Implement the minimal fix to address the root cause
+4. **Verify Success**: Run the test to confirm it now passes
+5. **Document**: Add entry to `docs/TECHNICAL_DEBT.md` documenting:
+   - Bug description and symptoms
+   - Root cause analysis
+   - Test coverage added
+   - Lessons learned
+6. **Commit Together**: Test and fix MUST be committed in the same commit or immediately sequential commits
+
+**Rationale**: Bug fixes without tests are incomplete. Tests serve as regression prevention and documentation of expected behavior. If a bug was found manually, it means our test coverage has a gap that must be filled.
+
+**Exceptions**: The only acceptable reason to skip adding a test is if:
+- The bug is in test infrastructure itself
+- The bug requires external dependencies unavailable in CI (document in TECHNICAL_DEBT.md)
+- The bug is in a deprecated component being removed
+
+In all exception cases, document the rationale in the commit message and TECHNICAL_DEBT.md.
+
 ### Branching & Integration
 
 - Feature branches named `###-feature-name` where ### is numeric identifier
@@ -149,4 +173,8 @@ All feature specifications, plans, and implementations MUST be reviewed for cons
 
 This constitution supersedes all other development guidelines, practices, or conventions. When conflicts arise, this document governs. If this constitution is unclear or incomplete for a specific situation, propose an amendment rather than work around it.
 
-**Version**: 1.0.0 | **Ratified**: 2025-10-14 | **Last Amended**: 2025-10-14
+**Version**: 1.1.0 | **Ratified**: 2025-10-14 | **Last Amended**: 2025-10-16
+
+**Amendment History**:
+- **1.1.0** (2025-10-16): Added Bug Fix Protocol requiring tests for all bug fixes and documentation in TECHNICAL_DEBT.md
+- **1.0.0** (2025-10-14): Initial constitution ratified