F-002 fix: Remove secrets and externalize config

spec/sdd/decisions/001-store-legacy-app-under-project-web.md

@@ -0,0 +1,33 @@
+# ADR-001: Store legacy app under project web path
+
+## Status
+Accepted
+
+## Context
+Legacy PHP code was copied into `project/new`.
+That path does not explain app role.
+SQL dump also sits beside code in `project/` root.
+We need stable layout before deeper refactor.
+
+## Decision
+Store legacy web code under `project/web/index/new`.
+Store SQL dump under `project/sql/db-25052026.sql`.
+Keep internal legacy file tree unchanged inside module.
+Do not refactor code in same step.
+
+## Consequences
+- Good:
+  - repo layout shows what is web code and what is data
+  - ARNES design docs can point to stable paths
+  - future config and secret cleanup gets easier
+- Bad:
+  - move may require path-aware follow-up in later features
+  - repo still contains legacy secrets until later cleanup
+
+## Alternatives considered
+1. Keep code in `project/new` - rejected because path is temporary and vague.
+2. Move code to `project/app` - rejected because this is web module, not service code.
+3. Refactor layout and code now - rejected because scope would grow too much.
+
+## Date
+2026-05-25