F-002 fix: Remove secrets and externalize config

work/artifacts/F-001/architect.md

@@ -0,0 +1,31 @@
+# Architect Artefact — Feature: F-001
+
+## SDD Changes
+- Added `spec/sdd/architecture.md`
+- Added component docs:
+  - `spec/sdd/components/legacy-web-module.md`
+  - `spec/sdd/components/bulk-seo-worker.md`
+  - `spec/sdd/components/development-data-baseline.md`
+- Added ADR:
+  - `spec/sdd/decisions/001-store-legacy-app-under-project-web.md`
+
+## BDD Coverage
+- Added `spec/bdd/features/layout/legacy-app-layout.feature`
+- Coverage target:
+  - stable web module path
+  - stable SQL dump path
+  - design trace exists
+
+## Technical decisions
+- Use `project/web/index/new` as stable repo path for copied legacy web code.
+- Use `project/sql/db-25052026.sql` as stable path for local dev dump.
+- Keep legacy internal module tree unchanged in this feature.
+
+## Risks found
+- Legacy code has hard-coded secrets and production URLs.
+- External files `login.php` and `success.php` are not in repo.
+- SQL dump may contain production-like data.
+
+## Next step
+- Move files with no content change.
+- Re-run verify after move.