Add platform-agnostic PROJECT_SPEC.md for cross-language rewrite

[Copilot]

Comprehensive, AI-coding-ready specification extracted from the full Android codebase — describes what the app does without Android/Kotlin coupling.

What's in the spec (1,157 lines, 14 sections)

• Data Models — 8 schemas with field types, constraints, primary keys
• API Contracts — Exact endpoint paths, HTTP methods, auth mechanisms, full JSON request/response schemas for both VSDC (mTLS + PAC header) and ESDC (PIN-based)
• Business Rules — Invoice total formula, MD5 hash computation (serialize-nulls → MD5 → hex), referent document regex, credential cache TTL (15min), catalog search heuristic (digits → barcode, else → name)
• Feature Workflows — Pseudocode flows for invoice creation (normal/copy/refund), catalog CRUD + import/export, journal filtering/streaming export, server configuration (VSDC cert provisioning vs ESDC IP setup)
• Import/Export Formats — CSV and JSON schemas with validation rules, batch sizes, dedup logic
• Security — Certificate OID structure (1.3.6.1.4.1.49952.X.Y.Z), encrypted preference keys, credential lifecycle
• Error Codes — Server codes (2xxx series), catalog/journal/cert download error enums

Design choices for AI readability

All enums include exact API string values. Workflows use → flow notation. Validation rules are regex patterns and numeric ranges. No Android API references — everything expressed as formulas, schemas, and pseudocode.

Example: Hash computation spec (§6.2)

1. Set hash field to null
2. Serialize InvoiceRequest to JSON with null values included
3. Compute MD5 of the UTF-8 bytes
4. Convert digest to lowercase hex string
5. Assign hex string to hash field, then send

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.