docs: close the valid CodeRabbit findings on PR 21

Two review gates could not be met: add-page-block's Validation and the
Code Review Standards checklist both required axe-core tests to pass
while no suite runs them. They now name the manual checks that apply
today and leave automated axe to its owner. The code-review skill now
says the API rejects a mismatched tenant or organization header with a
404, as ADR-0036 decides. Phase 07 placed tenant-defined custom fields
on the global User, which Phase 03's ownership table moves to
MembershipProfile because users carries no tenant boundary.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: cemililik

.claude/skills/add-page-block/SKILL.md

@@ -232,8 +232,11 @@ the page.
   editor.
 - For a tenant block: a page can be authored that uses the new block; the
   renderer dispatches correctly.
-- Accessibility (`axe-core`) and contrast checks pass — Step 7 says what runs `axe-core`
-  and names the Phase 02d gate open on it.
+- Accessibility: a keyboard walkthrough of the block and a contrast check of its text
+  and UI colours pass, per
+  [Accessibility Standards § Testing](../../../docs/standards/16-accessibility.md#testing),
+  recorded in the PR description. Automated `axe-core` is not a gate yet — Step 7 names
+  its owner and G43, the Phase 02d gate open on it.
 
 ## Common pitfalls
 

.claude/skills/code-review/SKILL.md

@@ -164,7 +164,8 @@ This is the lens that generic reviewers miss. Walk:
 - For frontend changes: route group is correct, SDK is the only API path,
   middleware-resolved `x-tenant-id` / `x-organization-id` honoured, no
   hand-rolled `fetch('/v1/...')`. The API treats an `X-Tenant-Id` or `X-Organization-Id`
-  it receives as an assertion, never a source
+  it receives as an assertion, never a source: it validates the header against its own
+  resolution and answers a mismatch with `404`
   ([ADR-0036](../../../docs/decisions/0036-tenant-resolution-trusted-inputs.md#one-header-names-a-host-and-it-is-still-not-a-source)).
   Whether the frontend holds a tenant or organization id at all, and what the middleware
   carries inward, is G25 and G36 in

docs/roadmap/phase-07-enrollment-learner-portal.md

@@ -140,7 +140,8 @@ Built on the Studio shell, permission system, and typed SDK from
 - Lesson resources.
 - Progress summary (driven by `TenantCompletionRule`).
 - Profile basics (with optional tenant-defined custom fields via `TenantCustomFieldDef`
-  on `User`).
+  on `MembershipProfile`, per
+  [Phase 03 § Tenant Data Ownership](phase-03-identity-admin.md#tenant-data-ownership-dsar-boundary-and-pii-classification)).
 
 ### Progress Tracking
 

docs/standards/17-code-review.md

@@ -65,7 +65,7 @@ Before requesting reviews, run the relevant checklist on your own diff:
   ([Security Standards § Multi-Tenant + Organization Isolation Review Checklist](11-security.md#multi-tenant--organization-isolation-review-checklist)).
 - [ ] New forms use React Hook Form + Zod and render errors at the field level.
 - [ ] New routes have `error.tsx` and `loading.tsx` where appropriate.
-- [ ] Accessibility: every interactive element keyboard-reachable; labels associated; color contrast checked; axe-core tests pass.
+- [ ] Accessibility: every interactive element keyboard-reachable; labels associated; color contrast checked; axe-core tests pass where a suite runs them — none does yet (see the note below).
 - [ ] Bundle size delta acceptable on public routes (< 200 KB gzipped per route).
 
 > **Open in Phase 02d.** No axe-core suite exists in `frontend/` today, and