Adds reverse engineering docs and adds new aidlc feature for front-end development

aidlc-docs/features/cms-frontend/inception/requirements/requirement-clarification-questions.md

@@ -0,0 +1,23 @@
+# Requirements Clarification Questions — CMS Frontend
+
+I detected a contradiction in your responses that needs clarification:
+
+## Contradiction: Authentication Security vs. Security Baseline
+
+You indicated **JWT in localStorage** (Q2: A) but also **Enforce all SECURITY rules as blocking constraints** (Q11: A).
+
+Storing JWT tokens in `localStorage` is a known security vulnerability — XSS attacks can steal tokens from localStorage. When the Security Baseline extension is enforced, this pattern is typically flagged as a **blocking security finding**.
+
+This means either:
+- The security baseline must be applied → the localStorage auth approach cannot be used
+- The localStorage auth approach is acceptable → security baseline must be relaxed or skipped
+
+### Clarification Question 1
+How should this contradiction be resolved for the cms-frontend project?
+
+A) Use a secure authentication approach (access token in memory + refresh token in httpOnly cookie) AND keep the security baseline enforced — this is the secure production-ready choice
+B) Keep localStorage for now (faster to implement, familiar) AND disable the security baseline — acceptable for a prototype/development phase
+C) Keep localStorage for now AND keep the security baseline, but acknowledge and document this as an accepted risk / technical debt
+X) Other (please describe after [Answer]: tag below)
+
+[Answer]: