Phase 5 cleanup

.github/copilot-instructions.md

@@ -36,6 +36,14 @@ The `docs/instructions/` directory contains best practices and conventions that
 - **`docs/instructions/keycloak.md`** — Auth integration, JWT claims, guards, token refresh
 - **`docs/instructions/testing.md`** — Vitest unit/integration/E2E test patterns, coverage targets
 
+## Tool Usage Rules
+
+- **Always use `read_file` to read file contents** — never use terminal commands like `Get-Content`, `cat`, `head`, or `tail` to read files. These will be denied.
+- **Always use `grep_search` or `file_search` to find files and patterns** — never use `Select-String`, `grep`, `find`, or `rg` in terminal commands.
+- **Run scripts only via `npm run <script>`** — never use `npx`, and never add flags like `2>&1`, pipes (`|`), or `Select-Object` to `npm run` commands.
+- **Use `execution_subagent` for build/test/lint commands** — it runs `npm run build`, `npm run test`, and `npm run lint` and returns relevant output without piping.
+- **Every implementation task must end with**: `npm run build`, `npm run test`, and `npm run lint` all passing.
+
 ## Key Rules
 
 1. **All domain types and Zod schemas live in `packages/shared`** — never duplicate types across packages.
@@ -47,3 +55,4 @@ The `docs/instructions/` directory contains best practices and conventions that
 7. **Cursor-based pagination** — never use `skip()` for large collections.
 8. **ESM everywhere** — `"type": "module"`, `.js` extensions on imports, `import type` for type-only imports.
 9. **Zod v4** — import from `'zod/v4'`, use `z.enum()` for enums, `z.email()` / `z.url()` as top-level.
+10. **No `.js` extensions on `@/` imports in `packages/web`** — Next.js resolves TypeScript files directly; `.js` extensions on `@/` path-alias imports break Turbopack and webpack. Only use `.js` extensions in `packages/api` and `packages/shared` (Node ESM).