refactor: code quality improvements across the backend

- Remove insecure SSL verification bypass in attendance.py
- Add gunicorn as production WSGI server (Dockerfile + entrypoint)
- Fix silent data loss in reconciliation (log + surface unmatched members)
- Add required column validation in payment sheet parsing
- Add input validation on /qr route (account format, amount bounds, SPD injection)
- Centralize configuration into scripts/config.py
- Extract credentials path to env-configurable constant
- Hide unmatched transactions from reconcile-juniors page
- Fix test mocks to bypass cache layer (all 8 tests now pass reliably)
- Add pytest + pytest-cov dev dependencies
- Fix typo "Inffering" in infer_payments.py
- Update CLAUDE.md to reflect current project state

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

CLAUDE.md

@@ -4,22 +4,12 @@ This file provides guidance to Claude Code (claude.ai/code) when working with co
 
 ## Project Status
 
-This is a greenfield project in early discovery/design phase. No source code exists yet. The project aims to automate financial and operational management for a small sports club.
-
-See `docs/project-notes.md` for the current brainstorming state, domain model, and open questions that need answering before implementation begins.
+Flask-based financial management system for FUJ (Frisbee Ultimate Jablonec). Handles attendance-based fee calculation, Fio bank transaction sync, payment reconciliation, and a web dashboard.
 
 ## Key Constraints
 
 - **PII separation**: Member data (names, emails, payment info) must never be committed to git. Enforce config/data separation from day one.
-- **Incremental approach**: Start with highest-ROI automation (likely fee billing & payment tracking), not a full platform.
-
-## Development Workflow
-
-This project uses a hybrid workflow:
-- Claude.ai chat for brainstorming and design exploration
-- Claude Code for implementation
-
-## When Code Exists
+- **Configuration**: External service IDs, credentials, and tunable parameters are centralized in `scripts/config.py`. Domain-specific constants (fees, merged months) stay in their respective modules.
 
 ## Development Setup
 
@@ -40,7 +30,7 @@ Alternatively, use the Makefile:
 - `make web`       - Start dashboard
 - `make image`     - Build Docker image
 
-Requires `credentials.json` in the root for Google Sheets API access.
+Requires `.secret/fuj-management-bot-credentials.json` for Google Sheets API access (configurable via `CREDENTIALS_PATH` env var).
 
 ## Git Commits