F-002 fix: Remove secrets and externalize config

project/web/index/new/config/README.md

@@ -0,0 +1,17 @@
+# Local config setup
+
+1. Copy `local.example.php` to `local.php`.
+2. Fill real local DB, OpenAI, and URL values in `local.php`.
+3. Keep `local.php` out of git.
+
+Config keys used by the legacy module:
+- `db.*`
+- `openai.*`
+- `store.*`
+- `routes.*`
+- `security.form_password_hash`
+- `worker.*`
+
+The module loads:
+- real local values from `config/local.php`
+- safe fallback values from `config/local.example.php`

project/web/index/new/config/local.example.php

@@ -0,0 +1,35 @@
+<?php
+
+return [
+    'db' => [
+        'host' => '127.0.0.1',
+        'port' => 3306,
+        'database' => 'CHANGE_ME_DB_NAME',
+        'user' => 'CHANGE_ME_DB_USER',
+        'password' => 'CHANGE_ME_DB_PASSWORD',
+        'charset' => 'utf8',
+    ],
+    'openai' => [
+        'api_key' => 'CHANGE_ME_OPENAI_API_KEY',
+        'model' => 'gpt-4o-mini',
+        'endpoint' => 'https://api.openai.com/v1/chat/completions',
+    ],
+    'store' => [
+        'name' => 'Natural - Mercado de Vida',
+        'language_es' => 4,
+        'language_en' => 1,
+        'image_base_url' => 'https://example.local/image/',
+        'product_base_url' => 'https://example.local/index.php?route=product/product&product_id=',
+    ],
+    'routes' => [
+        'login_url' => '../login.php',
+        'success_url' => 'https://example.local/producto-nuevo/success.php',
+    ],
+    'security' => [
+        'form_password_hash' => 'CHANGE_ME_FORM_PASSWORD_HASH',
+    ],
+    'worker' => [
+        'batch_size' => 20,
+        'min_html_length' => 500,
+    ],
+];