F-002 fix: Remove secrets and externalize config

work/artifacts/F-001/implementer.md

@@ -0,0 +1,38 @@
+# Implementer Artefact — Feature: F-001
+
+## Summary
+Moved legacy PHP module into stable ARNES project path.
+Moved SQL dump into stable project data path.
+Kept legacy module internal tree unchanged.
+Updated local project path docs.
+
+## Changes
+- moved `project/new` -> `project/web/index/new`
+- moved `project/db-25052026.sql` -> `project/sql/db-25052026.sql`
+- updated `project/README.md`
+- updated `spec/tech.md`
+- updated `work/current.md`
+
+## Evidence
+- before file count in module: `124`
+- after file count in module: `124`
+- before size of module: `640K`
+- after size of module: `640K`
+- SQL dump present after move: `project/sql/db-25052026.sql` (`229M`)
+- old path removed: `project/new`
+- verify result: `./scripts/verify.sh` OK
+
+## Checks run
+- `find project/new -type f | wc -l`
+- `du -sh project/new project/db-25052026.sql`
+- `mv project/new project/web/index/new`
+- `mv project/db-25052026.sql project/sql/db-25052026.sql`
+- `find project -maxdepth 4 | sort`
+- `find project/web/index/new -type f | wc -l`
+- `du -sh project/web/index/new project/sql/db-25052026.sql`
+- `./scripts/verify.sh`
+
+## Notes
+- No functional refactor done.
+- No secret cleanup done.
+- External dependencies `login.php` and `success.php` still live outside repo.