F-002 fix: Remove secrets and externalize config

spec/tech.md

@@ -1,19 +1,37 @@
 # Technical Spec
 
 ## Stack
-- Lenguaje:
-- Framework:
-- Runtime:
+- Language: PHP, JavaScript, CSS
+- Framework: legacy custom PHP + OpenCart database schema
+- Runtime: Apache/Nginx + PHP, MariaDB/MySQL, CLI worker for batch jobs
 
-## Restricciones
-- Seguridad:
-- Rendimiento:
-- Compatibilidad:
+## Restrictions
+- Security:
+  - do not expose secrets in new docs
+  - keep real dump as local dev input only
+- Performance:
+  - file move must not change app code behavior
+- Compatibility:
+  - preserve relative file structure inside legacy module
+  - preserve SQL dump file content
 
-## Dependencias
-Lista y justificación de dependencias externas.
+## Dependencies
+- MariaDB/MySQL dump from `project/sql/db-25052026.sql`
+- OpenCart tables like `oc_product`, `oc_product_description`, `oc_product_queue`
+- OpenAI API used by legacy scripts
+- External login and success endpoints exist outside this repo
 
-## Observabilidad
+## Observability
 - Logging:
-- Métricas:
-- Alertas:
+  - current legacy logs live under module `logs/`
+- Metrics:
+  - none in repo now
+- Alerts:
+  - none in repo now
+
+## F-002 technical notes
+- Add `bootstrap.php` in legacy module root.
+- Add config files under `project/web/index/new/config/`.
+- Versioned file stores example values only.
+- Ignored local file stores real local secrets and URLs.
+- All PHP entry points must read DB, OpenAI, and route values through config helper.