F-002 fix: Remove secrets and externalize config

work/artifacts/F-001/reviewer.json

@@ -0,0 +1,14 @@
+{
+  "feature_id": "F-001",
+  "agent": "reviewer",
+  "verdict": "APPROVED",
+  "summary": "Layout move is correct. SDD and BDD trace exist. Legacy module and SQL dump now live in explicit stable paths. No file loss was found in move evidence.",
+  "evidence": [
+    "Reviewed work/artifacts/F-001/architect.md",
+    "Reviewed work/artifacts/F-001/implementer.md",
+    "Checked project tree under project/web/index/new and project/sql/db-25052026.sql",
+    "Confirmed old path project/new is removed",
+    "Confirmed ./scripts/verify.sh is green"
+  ],
+  "timestamp": "2026-05-25T05:45:00Z"
+}