feat: confluence benchmark, pattern extractor, agent KB, UX spec

- extract-patterns.js: mines layered arch, ArgoCD appsets, cloud regions,
  CIDR allocations, naming conventions, sync waves, tech stack from code
- agent-kb.js: token-efficient JSON rendering of same doc tree
- eval-confluence-ref-questions.json: 32 reference-only benchmark questions
- wiggum-v2.sh: Ralph Wiggum loop targeting confluence baseline (77.8%)
- docs/human-ux-spec.md: BMad UX designer spec for human doc structure
- Eval results: V2 at 28.7% vs confluence 77.8% baseline
- Hub/spoke ownership now correctly extracted (95% on that question)
- Naming conventions, regions, CIDRs surfaced in system-architecture.md

foxtrot-docs-v3/reference/subsystems/app-tools.md

@@ -0,0 +1,73 @@
+# Subsystem: app-tools
+
+**Kind:** cross-cutting
+**Files:** 17
+**Functions:** 92, **Classes:** 4
+
+## Dependencies
+### Depended On By
+- ← app-common: 1 calls, 0 imports
+- ← compute-tools: 4 calls, 0 imports
+- ← ipam-tools: 6 calls, 0 imports
+
+## Public Exports
+- `Config`
+- `EnvExporter`
+- `FILES_TO_COPY`
+- `GitManager`
+- `cleanup`
+- `clone_repo`
+- `commit_and_push_changes`
+- `create_ak_sk`
+- `create_ak_sk_for_dph_user`
+- `create_ak_sk_for_es_user`
+- `create_ak_sk_for_export_user`
+- `create_aurora_mysql_db`
+- `create_db_subnet_group`
+- `create_gcp_bq_services`
+- `create_gcp_project`
+- `create_kms_key`
+- `create_rdm_gcp_bq_services`
+- `create_s3_buckets`
+- `create_security_group`
+- `display_help`
+- `emit_exports`
+- `enable_api_and_wait`
+- `enable_project_apis`
+- `ensure_gcs_bucket_exists`
+- `ensure_s3_bucket_exists`
+- `format_seconds`
+- `gcp_project_exists`
+- `generate_strong_password`
+- `get_aws_account_number`
+- `get_env_vars`
+- `get_matching_user`
+- `get_projects`
+- `get_rdm_mdm_companions`
+- `get_sensitive_input`
+- `get_verified_gcs_client`
+- `get_verified_s3_client`
+- `handle_api_error`
+- `list_private_subnets`
+- `list_rds_subnet_groups`
+- `log_error`
+- `log_exception`
+- `log_info`
+- `log_step`
+- `main`
+- `patch_crossaccount_mdm_companions`
+- `patch_mdm_policy_rdm_companion_arn`
+- `patch_mdm_systemdynamodb_shared_devops_api`
+- `patch_shared_devops_api_mdm_arns`
+- `patch_trust_policy_for_dataquality_snapshot`
+- `patch_vault_secret`
+- `print_summary`
+- `process_template_file`
+- `set`
+- `set_iam_policy_for_project`
+- `transfer_files`
+- `update_dynamic_secrets`
+- `update_terraform_config`
+- `vault_secret_bootstrap`
+- `wait_for_dynamodb_role`
+- `wait_for_operation`