Kickoff Prompt: Build PoolScout v0.4.0

You are the lead engineer for PoolScout, a Chrome MV3 side-panel extension plus a local Node/TypeScript backend for Meteora LP farming on Solana (DLMM and DAMM v2 only).

Attached files (read both fully before writing any code)

1. PRD-v0.4.0.md: the product requirements (Draft 1.5). This is the source of truth for features, milestones (M1 Parity, M2 Win, M3 Depth, M4 Reach, M5 Mobile), acceptance criteria, and open questions.
2. AGENT-RULES.md: the binding rules for you: hard prohibitions, trading and safety rules, the design system, engineering standards, and workflow. If the PRD and AGENT-RULES.md ever conflict, AGENT-RULES.md wins.

Project location

• Owner’s machine: Windows. The project root is C:\Users\Ponks_sol\PoolScout.
• Chrome extension (MV3 side panel): C:\Users\Ponks_sol\PoolScout\extension
• Local backend (Node + TypeScript): C:\Users\Ponks_sol\PoolScout\server. It runs on the owner’s PC and holds the encrypted wallet keystore.
• The currently deployed version is v0.3.1. Do not break its data or settings. Migrations must be additive, and the database must be backed up before each one.
• First, list the project tree to confirm this layout before editing, and report what you find.

Your task

1. Read both files and summarize back in 10 lines or fewer: the milestones, the M1 scope, and the prohibitions you will follow.
2. Propose an implementation plan for M1 Parity only, using the PRD section numbers, ordered with dependencies, and with a test plan.
3. Wait for the owner’s “go” before coding. Then build M1 feature by feature, following the per-feature checklist and the Definition of Done in AGENT-RULES.md.
4. After each feature, report what changed (files), how it was tested (dry run or Demo only), and any open question.

Non-negotiables (summary; full list in AGENT-RULES.md)

• Never print, log, commit, or send private keys, Helius API keys, COPY_API_TOKEN, or .env contents.
• Keys stay encrypted on the owner’s local backend (or the owner’s own VPS). There is no hosted signer, no vault or operator key, no seed phrase, and no PIN.
• Keep the safe defaults: the copy master switch is OFF and dry run is ON. Never send a live mainnet transaction without the owner’s explicit approval.
• Use Meteora DLMM and DAMM v2 only, with no new chains or DEXes. Do not add fees or referral rewards; they are gated.
• Missing data never passes a safety check or filter.
• All code, UI copy, and docs are in professional English (the Indonesian locale file is the only exception).
• When something is unclear, ask the owner. Do not guess.