F-002 fix: Remove secrets and externalize config

spec/sdd/components/legacy-web-module.md

@@ -0,0 +1,32 @@
+# Component: Legacy web module
+
+## Responsibility
+Serve old PHP pages for product create and product SEO work.
+Render HTML.
+Read OpenCart data.
+Write queue rows for batch processing.
+
+## Interfaces
+- Input:
+  - browser GET and POST requests
+  - session state from external login flow
+- Output:
+  - HTML pages
+  - inserts into `oc_product_queue`
+  - writes brand rows and URL alias rows
+
+## Dependencies
+- `db/conn.php`
+- `inc/header.php`, `inc/footer.php`
+- OpenCart tables
+- external `success.php` and `login.php` outside repo
+
+## Limits
+- Does not own authentication.
+- Does not own final product creation endpoint.
+- Uses hard-coded config today.
+
+## Success criteria
+- [ ] Module files live under stable repo path
+- [ ] Relative module structure stays intact
+- [ ] Pages can still be reviewed as one legacy unit