docs(rules): consolidate and streamline coding standards

- Compress `.claude/rules/` files by removing duplicate examples and combining related sections
- coding-style.md: Simplify layer check table, consolidate naming/syntax rules, add type guard pattern at API boundaries
- prisma-db.md: Update ERD.md rule to use schema.prisma inline comments (ERD.md auto-regenerated by prisma-erd-generator)
- svelte-components.md: Remove verbose examples, retain core patterns
- svelte-runes.md: Consolidate derived state and reactivity patterns
- sveltekit.md: Compress load/error/action documentation
- testing-e2e.md: Streamline navigation patterns and fixture management
- testing.md: Consolidate mock helpers and parametrized test patterns

Overall: ~50% line reduction while preserving essential patterns and new rules added from PR #3316 review.

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>

Author: KATO-Hiro

.claude/rules/coding-style.md

@@ -1,178 +1,64 @@
 # Coding Style
 
-## Plan Time
-
-### Pre-Implementation Layer Check
-
-Before writing new logic, decide which layer it belongs to. Run this check at plan time (design/architecture phase, before writing any code):
-
-| Layer          | Directory                                                | Key constraints                                                            |
-| -------------- | -------------------------------------------------------- | -------------------------------------------------------------------------- |
-| DB schema      | `prisma/`                                                | Migrations are immutable after apply                                       |
-| DB access      | `src/lib/server/`                                        | Server-only; never import in client code                                   |
-| Validation     | `src/**/zod/`                                            | `z.number().int()` for Int fields; comment dual-enforcement with SQL CHECK |
-| Domain types   | `src/**/types/` (`_types/` inside `src/routes/`)         | Plural aliases; TSDoc on every export; avoid `any`; see alternatives       |
-| Test data      | `src/**/fixtures/` (`_fixtures/` inside `src/routes/`)   | Write before implementation (TDD); use realistic values                    |
-| Business logic | `src/**/services/`                                       | Return pure values or `null`; no `Response`/`json()`                       |
-| External APIs  | `src/lib/clients/` or `src/features/*/internal_clients/` | Shared APIs → `lib/clients/`; feature-scoped APIs → `internal_clients/`    |
-| Pure utilities | `src/**/utils/` (`_utils/` inside `src/routes/`)         | No side effects; adjacent unit test required                               |
-| State          | `src/**/stores/`                                         | `.svelte.ts`; class + `$state()`; singleton export                         |
-| Route handlers | `src/routes/`                                            | Page: `redirect()`; API: `error()`                                         |
-| UI components  | `src/**/*.svelte`                                        | Svelte 5 Runes; business logic → `utils/`                                  |
-
-## Code Structure
-
-### Naming
-
-- **Abbreviations**: avoid non-standard abbreviations (`res` → `response`, `btn` → `button`). When in doubt, spell it out.
-- **Lambda parameters**: no single-character names (e.g., use `placement`, `workbook`). Iterator index `i` is the only exception.
-- **`upsert`**: only use when the implementation performs both insert and update. For insert-only, use `initialize`, `seed`, or another accurate verb.
-- **Function verbs**: every function name must start with a verb. Noun-only names (`pointOnCircle`, `arcPath`) are ambiguous — use `calcPointOnCircle`, `buildArcPath`, etc. Common prefixes: `get` (read existing), `build`/`create` (construct new), `calc`/`compute` (derive by formula), `update`, `fetch`, `resolve`.
-- **`any`**: Before using `any`, check the value's origin. If unavoidable: use `ReturnType<typeof fn>` for complex returns, `Partial<T>` for partial objects, `obj as T & { prop: U }` for property extension. Last resort: `as unknown as T`.
-
-- **UI labels**: if a label does not match actual behavior, update it or add an inline comment explaining the intentional mismatch.
-- **Constant names**: reflect what the value IS (content), not what it is used for (purpose). e.g., a set holding all enum tab values is `EXISTING_TABS`, not `VALID_TABS`.
-- **New files**: before naming a new file or directory, grep the relevant `src/` directory to confirm existing conventions. Confirm at plan time, not during implementation:
-  - Custom files in routes (utilities, helpers, etc.): `snake_case` (e.g., `user_profile.ts`)
-  - SvelteKit special files: follow framework conventions (`+page.svelte`, `+page.server.ts`, `+server.ts`)
-  - Helper directories inside `src/routes/`: underscore-prefixed (`_utils/`, `_types/`, `_fixtures/`, `_components/`)
-  - Other directories: `kebab-case` (e.g., `contest-table/`)
-
-### Syntax
-
-- **Braces**: always use braces for single-statement `if` blocks. Never `if () return;` — write `if () { return; }`.
-- **Domain types over `string`**: when the Prisma schema uses an enum (e.g. `grade: TaskGrade`), the corresponding app-layer type must use the same enum — not `string`. A loose `string` type hides misspellings in fixtures and forces `as TaskGrade` casts throughout the codebase. When a field comes from an external source (form data, query params), validate and narrow it at the boundary; inside the app it must always be the domain type.
-- **Plural type aliases**: define `type Placements = Placement[]` instead of using `Placement[]` directly in signatures and variables.
-- **Empty `catch` blocks**: never use `catch { }` to silence errors. Either re-throw, log, or add a comment justifying suppression. Silent swallowing hides bugs.
+## Pre-Implementation Layer Check
 
-```typescript
-try { ... } catch (error) { console.error('...'); throw error; }  // good
-try { localStorage.setItem(key, value); } catch { /* unavailable */ }  // good + comment
-```
-
-### No Hard-Coded Values
+Before writing logic, decide which layer it belongs to:
 
-Extract magic numbers and strings to named constants. Never embed literal values whose meaning is not self-evident from the type or immediate context.
+| Layer          | Directory                                   | Constraints                                             |
+| -------------- | ------------------------------------------- | ------------------------------------------------------- |
+| DB schema      | `prisma/`                                   | Migrations immutable after apply                        |
+| DB access      | `src/lib/server/`                           | Server-only; never in client                            |
+| Validation     | `src/**/zod/`                               | `z.number().int()` for Int; dual-enforce with SQL CHECK |
+| Domain types   | `src/**/types/`                             | Plural aliases; TSDoc; avoid `any`                      |
+| Test data      | `src/**/fixtures/`                          | Write before impl (TDD); realistic values               |
+| Business logic | `src/**/services/`                          | Pure values/`null`; no `Response`/`json()`              |
+| External APIs  | `src/lib/clients/` or `*/internal_clients/` | Shared → `lib`; feature-scoped → `internal_clients`     |
+| Utilities      | `src/**/utils/`                             | No side effects; adjacent unit test required            |
+| State          | `src/**/stores/`                            | `.svelte.ts`; class + `$state()`; singleton export      |
+| Route handlers | `src/routes/`                               | Page: `redirect()`; API: `error()`                      |
+| Components     | `src/**/*.svelte`                           | Svelte 5 Runes; logic → `utils/`                        |
 
-```typescript
-// Bad: magic literals embedded inline
-if (grade >= 11) { ... }
-
-const response = await fetch('/api/workbooks/submit', options);
+## Naming
 
-// Good
-const MIN_GRADE = 11;
-const SUBMIT_URL = '/api/workbooks/submit';
+- **No abbreviations** unless standard (e.g., `id`, `url`)
+- **Lambda params**: no single-char (except `i` for loops)
+- **Function verbs**: `get` (read), `build`/`create` (construct), `calc`/`compute` (derive), `update`, `fetch`, `resolve`
+- **Domain enums**: use domain type, not `string` (validates at boundary, stays typed inside)
+- **Constants**: reflect content not purpose; extract magic numbers/strings
+- **Files**: `snake_case` in routes, `kebab-case` dirs, underscore-prefix helpers (`_utils/`, `_types/`)
 
-if (grade >= MIN_GRADE) { ... }
+## Syntax
 
-const response = await fetch(SUBMIT_URL, options);
-```
+- **Braces**: always for single-statement `if` blocks
+- **Catch blocks**: never silent; re-throw, log, or comment
+- **Plural aliases**: `type Items = Item[]` in signatures
+- **TSDoc**: every export; `@param`/`@returns` when non-obvious
 
-Place constants at the top of the file, or in a dedicated `constants/` module when shared across files.
+## Type Guards at API Boundaries
 
-#### Test Code: Status Code Constants
-
-Applies equally to test code. HTTP status codes especially benefit from named constants for clarity of intent.
+When receiving enum values from external APIs, validate with a type guard:
 
 ```typescript
-import * as statusCodes from '$lib/constants/http-response-status-codes';
-
-// Bad: what does 200 mean here?
-nock('http://localhost').get('/user').reply(200, data);
-nock('http://localhost').get('/user').reply(500);
-
-// Good: intent is immediately clear
-nock('http://localhost').get('/user').reply(statusCodes.OK, data);
-nock('http://localhost').get('/user').reply(statusCodes.INTERNAL_SERVER_ERROR);
+// Good: `isValidTaskGrade(value): value is TaskGrade`
+const grade = isValidTaskGrade(data.grade) ? data.grade : null;
 ```
 
-Test readers (reviewers, future maintainers) must quickly understand **what is being tested**. Named constants (`OK`, `UNAUTHORIZED`) communicate intent far better than numeric codes.
-
-### Function Ordering
-
-Within a file, order declarations as follows:
-
-1. Exported functions and classes (public API first)
-2. Internal helper functions (supporting the exports above)
-
-Place a private helper immediately after the single export that uses it. Place helpers shared by two or more exports at the end of the file.
-
-### URL Parameter Patterns
-
-#### null-as-ALL: Omitting Params for "All" State
-
-When a filter has an "all" or "unfiltered" state, omit the parameter entirely rather than using a magic value (e.g., "ALL", "\*").
-
-**Pattern:**
-
-- Parse function defaults to `null` when param is absent
-- `null` → "show all" (no filter applied)
-- URL: `/workbooks?tab=solution` (no `categories=`)
-- Browser back button naturally restores default "all" view
-
-**Benefit:** Cleaner URLs, intuitive history behavior, smaller sessionStorage footprint.
-
-**Example:** `parseWorkBookCategory()` defaults to `null` = all categories
-
-### Type Guards: Precise Narrowing for Excluded Values
-
-When a type guard intentionally excludes enum members, use `Exclude<T, 'VALUE'>` in the return type to match runtime behavior. Caller code then trusts the type system; no `as` casts needed.
+Extract to `src/lib/utils/` with adjacent tests.
 
-### Layer-Specific Responsibility: Normalization vs Filtering
+## Dead Code: Three-Condition Rule
 
-When filtering data by multiple criteria (format + role):
-
-- **Service layer**: Normalize raw data format (e.g., `null → PENDING`). Return all data; stay framework-agnostic and testable.
-- **UI layer**: Filter by role/context (e.g., "admin sees PENDING, user doesn't"). Apply display rules in component.
-
-**Benefit**: Services remain pure and unit-testable without mocking roles; UI logic explicit in one place.
-
-### Function Composition: Single Responsibility
-
-Separate independent transformations into distinct functions. Compose at call site.
-
-```typescript
-// groupBySolutionCategory(): pure grouping (testable)
-// filterGroupsByRole(): pure filtering by role (testable)
-let filtered = $derived(filterGroupsByRole(groupBySolutionCategory(workbooks, map), role));
-```
-
-**Benefit**: Each function testable in isolation; reusable in different contexts.
+Delete function only if: (1) zero callers, (2) replacement exists, (3) dependent fields also deleted.
 
 ## Documentation
 
-### Language Policy
-
-Write all project documentation (plans, dev-notes, guides, refactor notes) in Japanese. Write all source code comments, TSDoc, commit messages, and test titles in English. This keeps documentation readable for the team while keeping code comments universally accessible and searchable.
-
-**Exception**: The `## CodeRabbit Findings` section in `plan.md` must quote findings verbatim in their original language (English). Do not translate CodeRabbit output.
-
-### TSDoc
-
-Add TSDoc to every exported function, type, class. Minimum: `@param` (non-obvious), `@returns` (not evident from type). One-liner OK; multi-line for complex behavior only.
-
-### Documentation
-
-Write plans/dev-notes/guides in Japanese. Source code comments in English. Always specify language on code blocks (e.g., `typescript`, `sql`, `bash`). For Svelte 5 unclear behavior: fetch official docs via WebFetch, not training knowledge.
-
-## Security & Code Review
-
-- **Logging**: No user-identifiable data in `console.log`. Single authoritative log in service layer.
-- **CodeRabbit**: Run after all phases complete. Write `critical`/`high`/`medium` findings to `plan.md` verbatim; defer `nitpick` to PR CI.
-
-## `+page.server.ts` load() Error Handling
-
-Wrap calls to service functions in try-catch and return safe default values on failure, preventing a single service error from crashing the entire page.
-
-## Auth: Action Audit
-
-When adding an auth guard to one action in `+page.server.ts`, audit all other actions in the same file. Asymmetric guards (some actions protected, others not) are a recurring pattern of vulnerability.
-
-## Auth: success Flag and message Consistency
-
-When an action returns `success: false`, the `message` and `message_type` must also reflect failure. A success flag contradicting the message is a silent bug.
+- **Plans/dev-notes**: Japanese
+- **Code/commits/tests**: English
+- **TSDoc**: required on all exports
+- **Code blocks**: specify language (`typescript`, `sql`, `bash`)
 
-## Dead Code Deletion: Three-Condition Rule
+## Security
 
-Before deleting a function, grep the full project for callers. Deletion is safe only when all three conditions hold: (1) zero callers, (2) a replacement implementation exists, (3) any fields this function wrote to are also being deleted.
+- No user-identifiable data in logs
+- No Prisma imports in route handlers
+- Validate input at system boundaries
+- Return safe defaults on service errors

.claude/rules/prisma-db.md

@@ -98,12 +98,15 @@ user   User @relation(fields: [userId], references: [id])
 
 ## DB-Level Value Constraints
 
-Add `CHECK` constraints (via manual migration SQL) for:
+Add `CHECK` constraints (via manual migration SQL) for count and invalid enum values. Document with inline `schema.prisma` comments (e.g., `/// CHECK: count >= 0`) — `prisma-erd-generator` overwrites `ERD.md` on each migration.
 
-- `count` fields that must be non-negative (`count >= 0`)
-- Enum fields where specific values are invalid at the DB level (e.g. `grade != 'PENDING'`)
+## Service Layer Error Handling
 
-Document every `CHECK` constraint in `prisma/ERD.md` — it is the only place they are visible outside migration SQL.
+Catch Prisma errors in service functions, return domain values:
+- `P2025` (record not found) → `null` (no exception)
+- Other errors → re-throw (caller handles as 500)
+
+This removes Prisma imports from route handlers and enables easy testing with mocked returns.
 
 ## Dual-Enforcement Constraints