add no default parameters rule

Forcing every call site to be explicit eliminates a class of bugs where an unintended default silently slips through. Codifies the convention already established by prior commits (cd40483, b41652a, 8eb0f23).

ai/shared.md

@@ -24,6 +24,11 @@ guides (`backend-context.md`, `frontend-context.md`) extend these.
   possible - do not split lines unnecessarily
 - Variable names: use explicit, descriptive names - never single-letter or
   abbreviated variables (e.g. `$text` not `$t`, `$node` not `$n`)
+- Method/function/constructor parameters: do not use default values - every
+  call site must pass every argument explicitly. This eliminates a class of
+  bugs where an unintended default silently slips through (e.g. an
+  `isAdmin=false` or an empty `passwordHash`). Apply the same rule in tests
+  and fakes - if a helper accepts a value, every caller must supply it.
 - First, explore the codebase to understand existing patterns - look at similar
   files for reference before writing anything
 - Never use em dashes (—) in code, comments, or docblocks - use hyphens (-)