Rules: Capture session learnings on pins, deps, and specs/ links

frontend-rules.md: new "Frontend Dependencies & Pins" section
points at frontend/README.md as the canonical pin doc, restates
the pins-are-intentional rule, and documents the workspace npm
install location plus the orphan-audit pattern.

commit-and-docs-style.md: explicit no-specs/-in-public rule with
the AGENTS.md/CLAUDE.md exception; note that gh issue create lacks
a --type flag so issue type must be set via the web UI.

sources-of-truth.md: add frontend/README.md to the package-README
list and call out its pin/override/orphan content directly.

.claude/rules/commit-and-docs-style.md

@@ -27,6 +27,8 @@ Descriptions MUST conclude with a checklist of **Acceptance Criteria**:
 
 > Agents MUST create, edit, close, reopen, relabel, or otherwise modify GitHub issues only when explicitly requested by the user.
 
+The repo's issue templates use the new GitHub `type:` property (`Bug`, `Feature`) instead of `bug`/`idea` labels. `gh issue create` does not yet accept a `--type` flag, so when filing issues programmatically use `--label` only and tell the user to set the issue type via the web UI.
+
 ## Specifications & Documentation
 
 - Document headings use a **Chicago-style title case**, with additional code- and path-aware normalization rules (see below). Always spell the product name as `PhotoPrism`.
@@ -35,6 +37,7 @@ Descriptions MUST conclude with a checklist of **Acceptance Criteria**:
 - Technical specifications in the nested `specs/` subrepository may not be present in every clone or environment. Do not add `Makefile` targets in the main project that depend on `specs/` paths.
   - Auto-generated configuration and command references live under `specs/generated/`. Agents MUST NOT read, analyze, or modify anything in this directory.
   - Nested Git repositories may appear to be ignored; if so, change directories before staging or committing updates.
+- **Never reference `specs/` paths from public artifacts** — issue bodies, PR descriptions, package READMEs (`frontend/README.md`, `internal/*/README.md`, etc.), top-level `CODEMAP.md`/`GLOSSARY.md`, code comments outside `specs/`. External readers see a 404 and the private subrepo's existence is leaked. Hints in `AGENTS.md` and `CLAUDE.md` files are the documented exception. Quick check: `grep -n "specs/" <file>` should return no matches before saving any public-facing file.
 
 > **Title Case** rules (Chicago-style headline capitalization, with code- and path-aware normalization):
 > - Capitalize the first word, the first word after a colon, dash, or end punctuation, and all major words, including the second part of a hyphenated major word.

.claude/rules/frontend-rules.md

@@ -1,3 +1,10 @@
+## Frontend Dependencies & Pins
+
+- `frontend/README.md` is the canonical doc for pin rationale, the `overrides` layer, ESM-only upgrade blockers, and the orphan-audit pattern — read it before bumping any non-caret pin or adding/removing a top-level dep.
+- **Pins are intentional.** When a version has no caret (e.g., `"axios": "1.16.0"`, `"vuetify": "3.12.2"`), check `frontend/README.md` and `git log -p -S "<pkg>" -- frontend/package.json` for the reason before changing it.
+- npm is a workspace; run `npm install --ignore-scripts --no-audit --no-fund --no-update-notifier` from the **repo root** (not `frontend/`) so the root `package-lock.json` updates. After dep changes also run `make audit`, `make build-js`, `make test-js`, and `make notice`.
+- Before adding a new dep or removing one as "unused", run `rg -nF "<pkg>" frontend ...` plus `npm ls <pkg> --all` to confirm there's no transitive consumer or peer-dep. Recent precedents: `postcss-url`, `@vitejs/plugin-react`, `cheerio`, `@testing-library/react`, `vite-tsconfig-paths` (all true orphans removed once consumer left).
+
 ## Frontend Test Coverage
 
 - Test new JS functions (including helpers) and new Vue components whenever practical; update existing tests when behavior changes.

.claude/rules/sources-of-truth.md

@@ -8,7 +8,8 @@
 - REST API: https://docs.photoprism.dev/ (Swagger), https://docs.photoprism.app/developer-guide/api/ (Docs)
 - Code Maps: `CODEMAP.md` (Backend/Go), `frontend/CODEMAP.md` (Frontend/JS)
 - Terminology Glossary: `GLOSSARY.md` (single source for term definitions across specs/docs)
-- Package-level `README.md` files under `internal/`, `pkg/`, and `frontend/src/` for detailed package documentation.
+- Package-level `README.md` files under `internal/`, `pkg/`, `frontend/`, and `frontend/src/` for detailed package documentation.
+- Frontend dependency pin rationale, override layer, and orphan-audit pattern: `frontend/README.md` (check before bumping any non-caret pin or adding/removing a top-level dep).
 
 > Quick Tip: to inspect GitHub issue details without leaving the terminal, run `curl -s https://api.github.com/repos/photoprism/photoprism/issues/<id>`; if `gh` is set up, you MAY also run `gh issue view <id> -R photoprism/photoprism`.