Work the task backlog in CLAUDE.md.

1. Read CLAUDE.md, especially "Critical context" and "Task backlog".
2. Pick the lowest-numbered task that is not yet done (default: $ARGUMENTS if a
   task id like T1 is given).
3. Restate the task and its acceptance criteria before writing any code.
4. Implement it demo-grade, following the repo conventions:
   - Fusion is shared SaaS — never build/host it or automate its console config.
   - Endpoints Fusion calls must be public HTTPS with auth.
   - Detection returns typed findings; we own minting/vault/restore.
   - Never commit AWS creds, secrets, or real PII; seed data is synthetic only.
   - Terraform runs with `-chdir=terraform`.
5. Do NOT run deploys or anything that incurs AWS spend without asking first.
6. When done: note what you changed in the relevant file, tick the task in
   CLAUDE.md, and state how you verified the acceptance criteria (or what still
   needs a human/live check).