F-002 fix: Remove secrets and externalize config

work/artifacts/F-001/qa.json

@@ -0,0 +1,22 @@
+{
+  "feature_id": "F-001",
+  "agent": "qa",
+  "verdict": "APPROVED",
+  "summary": "Acceptance criteria for layout move are satisfied. Design trace exists, target paths exist, old path is removed, and core harness verification is green.",
+  "traceability": [
+    "AC: SDD docs exist and explain current legacy app structure -> spec/sdd/architecture.md and component docs created",
+    "AC: ADR records why code moves under project/web and SQL under project/sql -> spec/sdd/decisions/001-store-legacy-app-under-project-web.md",
+    "AC: Legacy code is moved with same contents and no file loss -> implementer evidence shows same file count and size before/after",
+    "AC: SQL dump is kept as local development baseline in project/sql -> project/sql/db-25052026.sql exists and is referenced in docs",
+    "AC: verify.sh is green -> ./scripts/verify.sh passed after move"
+  ],
+  "evidence": [
+    "Reviewed spec/bdd/features/layout/legacy-app-layout.feature",
+    "Reviewed work/artifacts/F-001/implementer.md",
+    "Checked project/web/index/new exists",
+    "Checked project/sql/db-25052026.sql exists",
+    "Checked project/new is removed",
+    "Checked ./scripts/verify.sh output is OK"
+  ],
+  "timestamp": "2026-05-25T05:45:00Z"
+}