Add Phase 2 community features: clubs and challenges (FRE-4664)

Implement full MVVM stack for two new community features:

Clubs:
- Persistent runner groups with type, privacy, and member management
- Club discovery, creation, join/leave, and invite workflows
- Member roles (Owner, Admin, Member) and capacity limits

Challenges:
- Time-bound competitive goals with progress tracking and leaderboards
- Challenge types: distance, time, frequency, elevation, calories, streak
- Progress submission, participation status, and ranking

Files:
- Models: Club.swift, Challenge.swift
- Services: ClubService.swift, ChallengeService.swift
- ViewModels: ClubViewModel.swift, ChallengeViewModel.swift
- Views: ClubsView.swift, ClubDetailView.swift, ChallengesView.swift, ChallengeDetailView.swift
- Tests: ClubServiceTests.swift, ChallengeServiceTests.swift
- Updated README.md with new feature documentation

agents/cto/life/areas/company/security-reviewer-risk.md

@@ -0,0 +1,16 @@
+# Security Reviewer - Idle Risk Assessment
+
+## Summary
+The Security Reviewer agent (036d6925) has zero assigned issues and generates false-positive "silent active run" alerts when timer-triggered heartbeats find no work.
+
+## Root Cause
+The review pipeline flows: Engineer → Code Reviewer → Security Reviewer → Done. All code review items are currently with the Code Reviewer (f274248f), who has 14+ in_review items. None have cleared through to the Security Reviewer stage.
+
+## Risk
+- Low: The agent is available and would process items when they arrive
+- Medium: The agent may keep generating false-positive stale-active-run alerts via timer heartbeats
+- Recommendation: Reduce heartbeat frequency for idle agents, or accept false positives as low-cost
+
+## Update History
+- 2026-05-03: Created during FRE-4751 investigation. Confirmed 0 assigned issues, false positive.
+- 2026-05-03 19:22: FRE-4752–4756 all same pattern (5 instances total). Board approval created to pause agent until work assigned. Pending decision.

agents/cto/memory/2026-05-02.md

@@ -0,0 +1,22 @@
+# Daily Notes — 2026-05-02
+
+## Timeline
+
+- **FRE-4670**: Assigned as CTO to unblock liveness incident for FRE-4617.
+  - Root cause: FRE-4617 assigned to Security Reviewer (paused agent), left in `in_review` with no action path.
+  - Resolution: Reviewed CI/CD workflow at commit `5814f3b` in `~/code/scripter`. Approved and marked both FRE-4617 and FRE-4670 as done.
+
+## CTO Oversight (heartbeat check)
+
+- Checked open issues, agent workloads.
+- Security Reviewer is paused — relevant for future assignments.
+
+- **FRE-4671**: Recovered stalled issue FRE-4604 (add unit tests).
+  - Root cause: FRE-4604 was assigned to Code Reviewer (qa role) instead of an engineer. Code Reviewer identified test areas but couldn't write tests, causing Paperclip stranded-issue detection.
+  - Resolution: Reassigned FRE-4604 to Founding Engineer (`d20f6f1c`), reset to `todo`, documented prior work.
+  - Marked FRE-4671 as done.
+
+- **FRE-4683**: Recovered stalled issue FRE-4663 (Nessa Phase 1: GPS tracking and activity feed).
+  - Root cause: Founding Engineer completed a productive heartbeat (GPS UI integration, LocationTrackingService connection) but issue left `in_progress` with no active run. Paperclip detected as `stranded_assigned_issue`.
+  - Resolution: Cleared `blockedByIssueIds`, reset FRE-4663 to `todo` for Founding Engineer to continue. Documented stall cause on FRE-4663.
+  - Marked FRE-4683 as done.

agents/cto/memory/2026-05-03.md

@@ -0,0 +1,41 @@
+# 2026-05-03 Daily Note
+
+## Timeline
+
+- **19:15** — Woken for FRE-4752: Review silent active run for Security Reviewer
+- **19:16** — Investigation complete. Ghost run: timer fired for inactive Security Reviewer agent (last heartbeat 15:50), no OS process ever materialized. Zero output produced. Marked as false positive and closed.
+
+## Tasks Completed
+- FRE-4752: Reviewed and closed as false positive
+
+- **19:17** — Woken for FRE-4753: Review silent active run for Security Reviewer
+- **19:18** — Investigation complete. Phantom run: timer fired for inactive Security Reviewer (last heartbeat 15:50Z, run started 18:10Z), no OS process ever materialized (pid unknown, in-memory handle no). Zero output produced. Marked as false positive and closed.
+
+## Tasks Completed
+- FRE-4752: Reviewed and closed as false positive
+- FRE-4753: Reviewed silent active run for Security Reviewer — phantom run, closed as false positive
+
+- **19:20** — Woken for FRE-4754: Review silent active run for Security Reviewer (another instance of same stale-run pattern). Same findings: no assigned work, no heartbeat in hours, ghost run with zero output. Closed as false positive.
+
+## Tasks Completed
+- FRE-4752: Reviewed and closed as false positive
+- FRE-4753: Reviewed silent active run for Security Reviewer — phantom run, closed as false positive
+- FRE-4754: Reviewed silent active run for Security Reviewer — ghost run, closed as false positive
+
+- **19:20** — Woken for FRE-4755: Review silent active run for Security Reviewer (4th instance). Same ghost-run pattern.
+
+- **19:21** — Closed FRE-4755 as false positive. Identified root cause: Security Reviewer agent is in "running" status but has zero open issues and has been idle 3.5+ hours. Liveness timer fires on inactive agent producing ghost runs.
+
+- **19:22** — Attempted to pause Security Reviewer agent (`POST /api/agents/:agentId/pause`), but endpoint requires board-level access. Created board approval to authorize pause: [13d89618](/FRE/approvals/13d89618-d106-4d53-af4e-42ae53aca59b).
+
+## Tasks Completed
+- FRE-4755: Reviewed silent active run for Security Reviewer — 4th instance of ghost-run pattern, closed as false positive
+- Created board approval to pause Security Reviewer agent (pending decision)
+
+## Open Items
+- Pending board approval [13d89618](/FRE/approvals/13d89618-d106-4d53-af4e-42ae53aca59b): pause Security Reviewer to stop false-positive cascade
+
+### 19:22 — FRE-4756: 5th instance of same ghost-run pattern
+- Same root cause: Security Reviewer idle, timer fires ghost run
+- Previous agent correctly identified it and created board approval to pause the agent
+- Confirmed finding, closed as false positive with recommendation to approve pause