docs: 로컬 테스트 필수 조건 추가 (SSH 터널링, 배포 전 검증 가드)

## 변경사항

### CLAUDE.md
- '로컬 개발 & 테스트' 섹션 신규 추가
  * SSH 터널링 설정 (Docker 사용 금지)
  * appsettings.Development.json 설정
  * 로컬 서비스 시작 방법
- 배포 전 필수 체크리스트
  * Build (0 errors, 0 warnings)
  * 서비스 시작 확인
  * 로그인 테스트
  * 모든 Admin 페이지 검증 (200 상태, 500 에러 없음)
  * E2E 테스트 통과
- 배포 게이트: 로컬 테스트 통과 전 절대 배포 금지

### E2E 테스트
- complete-admin-flow.spec.ts 신규 추가
  * 모든 Admin 페이지 접근 테스트
  * 500 에러 감지
  * Authorization 검증

## 교훈

Authorization Policy 500 오류가 로컬에서 먼저 발견되었어야 했음.
Docker 없이 SSH 터널로 원격 DB 접속하는 현실을 반영하여 지침화.

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>

CLAUDE.md

@@ -264,6 +264,74 @@ UI: `Pages/Admin/Collection/Index.cshtml` — status 값에 따라 배지 색상
 4. **GetDailyItemChartPriceAsync** (FHKST03010100) — Daily OHLCV data
 5. **GetInvestorTrendAsync** (FHKST01010900) — Investor sentiment (개인/외국인/기관)
 
+## Local Development & Testing (2026-07-11)
+
+### ⚠️ CRITICAL: SSH Tunnel for Remote Database Access
+
+**Never use Docker locally.** Always use SSH tunneling to connect to remote PostgreSQL:
+
+```powershell
+# 1. Setup SSH tunnel (Terminal 1) — forwards local 5432 to remote DB
+ssh -L 127.0.0.1:5432:localhost:5432 kjh2064@178.104.200.7 -N
+
+# 2. Configure appsettings.Development.json
+{
+  "ConnectionStrings": {
+    "DefaultConnection": "Host=127.0.0.1;Database=quantenginedb;Username=quantengine_app;Password=quantengine_app;Search Path=quantengine;"
+  }
+}
+
+# 3. Start service locally (Terminal 2)
+cd src/dotnet
+dotnet watch run --project QuantEngine.Web
+
+# 4. Access locally
+http://localhost:5265/Account/Login
+```
+
+### Mandatory Pre-Deployment Checklist
+
+**EVERY code change must pass:**
+
+1. ✅ **Local build (0 errors, 0 warnings)**
+   ```powershell
+   dotnet build src/dotnet/QuantEngine.Web/QuantEngine.Web.csproj -c Release
+   ```
+
+2. ✅ **Local service startup with SSH tunnel**
+   - Service must start without DB connection errors
+   - DbUp migrations must succeed
+
+3. ✅ **Login test (admin/quant123!)**
+   - `/Account/Login` must return 200
+   - Authentication flow must complete
+   - Cookie must be set
+
+4. ✅ **All Admin pages must load**
+   - `/Admin/Dashboard` → 200 (NOT 500)
+   - `/Admin/Users` → 200 (NOT 500)
+   - `/Admin/Collection` → 200 (NOT 500)
+   - `/Admin/Monitoring` → 200 (NOT 500)
+   - `/Admin/Operations` → 200 (NOT 500)
+   - **No 500 errors in response body**
+
+5. ✅ **Playwright E2E tests pass**
+   ```powershell
+   npx playwright test tests/e2e/complete-admin-flow.spec.ts
+   ```
+
+### Deployment Gates
+
+**NEVER deploy without:**
+- ❌ Local testing complete
+- ❌ All Admin pages verified (200 status, no 500 errors)
+- ❌ E2E tests passing
+- ❌ Authorization Policy configured (if changes made to Program.cs)
+
+**Deployment failure is better than service outage.** Halt and investigate if local tests fail.
+
+---
+
 ## Notes for Contributors (2026-07-11)
 
 - **SQL Safety**: Whitelist-only table access (enum switch in Repository)
@@ -275,3 +343,4 @@ UI: `Pages/Admin/Collection/Index.cshtml` — status 값에 따라 배지 색상
 - **Legacy Code**: `QuantEngine.Web.Client` folder kept for reference (not in .sln, not built)
 - **Newtonsoft.Json**: Known high-severity vulnerability (GHSA-5crp-9r3c-p9vr); update or replace when feasible
 - **Release Authority**: Python gates (`full-gate`, `prepare-upload-zip`) remain authority; .NET Admin fully operational as of 2026-07-11
+- **Testing Requirement**: All code changes must pass local testing with SSH tunnel to remote DB before deployment (see "Local Development & Testing" above)