F-002 fix: Remove secrets and externalize config

spec/sdd/components/bulk-seo-worker.md

@@ -0,0 +1,33 @@
+# Component: Bulk SEO worker
+
+## Responsibility
+Read product ids from queue.
+Call OpenAI with EN and ES prompts.
+Clean output.
+Update OpenCart product description fields.
+Write processing logs.
+
+## Interfaces
+- Input:
+  - CLI run of `worker_bulk.php`
+  - rows from `oc_product_queue`
+  - prompt files `inc/prompt_en.md` and `inc/prompt_es.md`
+- Output:
+  - updates in `oc_product_description`
+  - status fields in `oc_product_queue`
+  - log files under `logs/`
+
+## Dependencies
+- MariaDB/MySQL
+- OpenAI Chat Completions API
+- local prompt markdown files
+
+## Limits
+- No secret management yet.
+- No retry queue store outside DB.
+- No metrics or structured logs.
+
+## Success criteria
+- [ ] Worker path is documented
+- [ ] Queue and DB side effects are known
+- [ ] Log location is explicit in design docs

spec/sdd/components/development-data-baseline.md

@@ -0,0 +1,24 @@
+# Component: Development data baseline
+
+## Responsibility
+Provide one local SQL dump so maintainers can inspect schema and seed dev database.
+
+## Interfaces
+- Input:
+  - SQL import command run by maintainer
+- Output:
+  - local MariaDB database with OpenCart and custom tables
+
+## Dependencies
+- `project/sql/db-25052026.sql`
+- local MariaDB/MySQL server
+
+## Limits
+- Dump may contain production-like data.
+- Dump is large.
+- Dump is not safe for public sharing without review.
+
+## Success criteria
+- [ ] Dump path is stable and explicit
+- [ ] Design docs call it dev baseline only
+- [ ] Move does not alter dump content

spec/sdd/components/legacy-config-loader.md

@@ -0,0 +1,30 @@
+# Component: Legacy config loader
+
+## Responsibility
+Load local configuration for the legacy PHP module.
+Expose helper access for DB, OpenAI, URLs, endpoints, and path values.
+Provide one DB connection factory used by web pages and worker.
+
+## Interfaces
+- Input:
+  - `config/local.php` if present
+  - fallback `config/local.example.php` for shape and safe defaults
+- Output:
+  - config access helpers
+  - mysqli connection helper
+  - normalized path values for logs and routes
+
+## Dependencies
+- PHP array config files
+- `mysqli`
+- module root path
+
+## Limits
+- Does not manage secret rotation.
+- Does not validate remote credentials.
+- Does not redesign auth or downstream business logic.
+
+## Success criteria
+- [ ] No tracked PHP file contains hard-coded DB or OpenAI secrets
+- [ ] Entry points use shared config helper
+- [ ] Local setup path is documented

spec/sdd/components/legacy-web-module.md

@@ -0,0 +1,32 @@
+# Component: Legacy web module
+
+## Responsibility
+Serve old PHP pages for product create and product SEO work.
+Render HTML.
+Read OpenCart data.
+Write queue rows for batch processing.
+
+## Interfaces
+- Input:
+  - browser GET and POST requests
+  - session state from external login flow
+- Output:
+  - HTML pages
+  - inserts into `oc_product_queue`
+  - writes brand rows and URL alias rows
+
+## Dependencies
+- `db/conn.php`
+- `inc/header.php`, `inc/footer.php`
+- OpenCart tables
+- external `success.php` and `login.php` outside repo
+
+## Limits
+- Does not own authentication.
+- Does not own final product creation endpoint.
+- Uses hard-coded config today.
+
+## Success criteria
+- [ ] Module files live under stable repo path
+- [ ] Relative module structure stays intact
+- [ ] Pages can still be reviewed as one legacy unit