docs: save CAB QA protocol and regression test suite for future use

- cab-qa.sh: 41-check CAB Change Advisory Board checklist
- regression.sh: 39-test comprehensive regression suite
- README.md: usage guide and CAB sections reference

These test suites validate deployment, security, functional,
integration, compliance, performance, and rollback readiness.

tests/README.md

@@ -0,0 +1,45 @@
+# Falah Mobile — QA Test Suite
+
+## CAB Change Advisory Board Protocol
+
+CAB checkpoints ensure every deployment meets functional, security, compliance, and operational standards before release.
+
+### Test Files
+
+| File | Description | Usage |
+|---|---|---|
+| `cab-qa.sh` | **CAB QA Checklist** — 41 checks covering deployment, functional, security, integration, compliance, performance, rollback | `bash tests/cab-qa.sh` |
+| `regression.sh` | **Regression Suite** — 39 tests covering health, CORS, rate limiting, auth, webhooks, error handling, gateway | `bash tests/regression.sh` |
+
+### Quick Start
+
+```bash
+# Against direct container
+bash tests/cab-qa.sh http://192.168.0.11:4014/mobile
+
+# Against gateway
+bash tests/cab-qa.sh http://192.168.0.11:7878/mobile
+
+# Regression test suite
+bash tests/regression.sh http://192.168.0.11:4014/mobile
+```
+
+### CAB Checklist Sections
+
+1. **CAB-01**: Change Description & Scope
+2. **CAB-02**: Risk Assessment
+3. **CAB-03**: Deployment Verification
+4. **CAB-04**: Functional Testing — Public Endpoints
+5. **CAB-05**: Functional Testing — Authenticated Endpoints
+6. **CAB-06**: Security Testing (OWASP-aligned)
+7. **CAB-07**: Integration Testing (Gateway)
+8. **CAB-08**: Compliance Testing (Shariah, Data Protection)
+9. **CAB-09**: Performance Testing
+10. **CAB-10**: Rollback Plan
+11. **CAB-11**: Sign-Off Summary
+
+### Required Environment
+
+- **Target**: Next.js app with `basePath: /mobile`
+- **Gateway**: nginx proxy at `:7878/mobile` → app `:4014/mobile`
+- **Docker**: Container with `--restart unless-stopped`, persistent volumes, network attached