phase-1: packages/rules complete, 100% covered

Every algorithm in docs/RULES.md, implemented exactly as written: the RUC
check digit, the calendario perpetuo with weekend and holiday roll forward,
CDC and KUDE QR parsing, keyword classification, computeF120, computeF515 and
the dashboard projections, plus the two form definitions.

Both worked examples reproduce verbatim on the first implementation: F120 at
Gs. 277.273 to pay with the Gs. 350.000 flip case, F515 at Gs. 11.290.000 on a
5,65% effective rate. 162 tests over the package, coverage enforced at 100%
statements, branches, functions and lines; the only exclusions are three
bounded-loop guards marked v8 ignore with a comment saying why.

No tax rule was invented. All six TODO-TAX-VERIFY items from RULES.md have a
test pinning today's behaviour and a row in the DECISIONS.md register, so
verification later is a red/green diff. Where RULES.md was silent the choice is
marked SPEC-GAP in the code and listed too, the notable one being that
taxpayer.hasIrp gates the deduction amount.

No floats anywhere in a money path: money is a branded Pyg of whole guaranies
and percentages go through integer arithmetic rounded half up.

Also: contracts now takes IRP_CATEGORIES from rules rather than declaring the
eight strings twice; classification returns reason codes with catalog strings
in both locales, so the detail sheet localizes; apps/api/.env.example now names
the same web port as apps/web/.env.example, without which a fresh checkout
fails sign in on the origin check.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

README.md

@@ -7,8 +7,8 @@ and ready to file yourself.
 Working name. See `docs/` for the specifications, `DECISIONS.md` for choices made along the
 way and the gaps that still need answers.
 
-> **Status: phase 0 of 8.** Foundation only. There is no tax logic, no ingestion and no
-> dashboard yet: `packages/rules` is waiting on `docs/RULES.md`, which is not in the repo.
+> **Status: phase 1 of 8.** Foundation and the tax rules. `packages/rules` is complete and
+> covered; there is no ingestion, dashboard or declaration UI on top of it yet.
 
 ---
 
@@ -23,9 +23,14 @@ pnpm db:seed
 pnpm dev
 ```
 
-The web app is on http://localhost:3000, the API on http://localhost:4000. `db:seed`
+The web app is on http://localhost:3005, the API on http://localhost:4000. `db:seed`
 prints the development sign in details for the four demo accounts.
 
+The web port lives in `apps/web/.env` and `apps/api/.env` has to name the same one in
+`APP_PUBLIC_URL` and `BETTER_AUTH_URL`. Auth checks the request Origin, so a mismatch
+fails sign in with a 403 that looks nothing like a port problem. `localhost` and
+`127.0.0.1` count as different origins too.
+
 Or the whole thing in containers, with nothing installed but Docker:
 
 ```bash
@@ -74,6 +79,7 @@ driver, and user facing strings cannot be written inline in JSX.
 |---|---|
 | `pnpm dev` | Both apps in watch mode |
 | `pnpm test` | Vitest across the workspace |
+| `pnpm test:coverage` | The tax rules with coverage, which fails below 100% |
 | `pnpm test:e2e` | Playwright against a running stack (`E2E_BASE_URL` to point it) |
 | `pnpm typecheck` | `tsc --noEmit` in every package |
 | `pnpm lint` | eslint, including the module boundary and inline copy rules |
@@ -125,12 +131,33 @@ localization and the date formatting all read from that array. `formatGs` never
 money is always `Gs. 1.234.567`. Official form previews and PDFs stay Spanish in every
 locale, because they mirror DNIT forms.
 
+## The tax rules
+
+Everything that decides a number lives in `packages/rules` and nothing there does I/O, so
+it is all directly testable. `docs/RULES.md` is authoritative for it and the module names
+follow that document's sections: `ruc.ts`, `calendario.ts`, `cdc.ts`, `classification.ts`,
+`f120.ts`, `f515.ts`, `projections.ts`.
+
+Three rules hold the package together:
+
+- **No floats in a money path.** Money is a branded `Pyg` of whole guaranies, percentages
+  go through `percentOf`, which is integer arithmetic rounded half up, and `pyg()` throws
+  on anything that is not a safe integer.
+- **Never guess a tax rule.** Anything `docs/RULES.md` does not state carries a
+  `TODO-TAX-VERIFY` comment and a test that pins today's behaviour, so verifying it later
+  is a red/green diff. `DECISIONS.md` has the register of all six.
+- **Data, not code.** The holiday table, the keyword to category map and the form
+  definitions are plain data files. Extending them for a new year or a new keyword is not
+  a code change.
+
+Coverage is enforced at 100%: `pnpm test:coverage` fails below it.
+
 ## Adding a form version
 
-Form definitions live in `packages/rules` and every declaration stores the `rulesVersion`
-that produced it, so an old declaration always renders with the rules it was computed
-under. Bump `RULES_VERSION`, add the new definition beside the old one, and leave the old
-one in place. (Fully specified once `docs/RULES.md` lands.)
+Form definitions live in `packages/rules/src/forms` and every declaration stores the
+`rulesVersion` that produced it, so an old declaration always renders with the rules it was
+computed under. Add `f120.v2.ts` beside `f120.v1.ts`, bump `RULES_VERSION`, and leave the
+old definition in place: it is what old declarations still render through.
 
 ## Testing