📝 docs: add comprehensive SOLID analysis and code review findings

- Documented SOLID principle violations across codebase
- Identified security best practice improvements needed
- Analyzed performance optimization opportunities
- Added detailed refactoring recommendations
- Updated ADR-0018 with JWT secret rotation reference
- Enabled gitea-client skill for programmer agent

This commit captures the current state analysis before implementing improvements.

adr/0018-user-management-auth-system.md

@@ -120,6 +120,7 @@ The user management system follows the established DanceLessonsCoach patterns:
    - 30-minute expiration for access tokens
    - Secure random signing key
    - HTTPS-only cookies
+   - **Secret Rotation:** Multiple valid secrets with retention policy (see Issue #8)
 3. **Admin Access:**
    - Master password from environment variable
    - Non-persisted admin user
@@ -464,6 +465,7 @@ The implementation maintains full backward compatibility:
 3. **User Activity Logging:** For audit trails
 4. **Password Strength Meter:** For better user experience
 5. **Account Recovery:** Email/phone-based recovery options
+6. **JWT Secret Rotation:** Implement secret persistence and rotation mechanism (Issue #8)
 
 ## References