refactor(structure): promote app to repo root + remove redundant workspace cruft

Standard production layout: the OKR app (was nested under AINative_OKR_CASAN5/) is now
the repository root. No more wrapper directory.

- Promote AINative_OKR_CASAN5/* -> repo root (backend/ frontend/ packages/ apps/
  .specify/ docs/ infra/ nginx/ scripts/ + configs). Merge tool dirs: .gitea (kept the
  active deploy ci.yml, added harness-ci.yml + runbooks), .claude (agents/commands +
  launch.json), .github moved up.
- Remove redundant: 00_SUBMISSION_PACKAGE, scattered root notes (FPT_CASAN_Full.md,
  tu-tuong-casan.md, casan-tu-sinh..., casan_harness_assessment.md, source-review...,
  README_CASAN5_REFINED.md), casan-next-plans/ and optimize-docs/ (competition/planning
  artifacts — roadmap + design history preserved in git log / commit messages).
- Update all references to the old layout:
  - .gitea/workflows/{ci,harness-ci}.yml, .github/workflows/{ci,deploy}.yml:
    working-directory .; drop AINative_OKR_CASAN5/ prefix; .specify/{tests,scripts}
    -> packages/casan-harness/... (.specify/logs state kept)
  - .claude/launch.json, .gitea/*-runbook.md: path prefixes
  - CLAUDE.md, README.md: docs/input -> apps/okr/domain/input
  - policy-bundle.yaml: 8 policy paths -> packages/casan-harness/...; manifest re-signed
- secrets-scan.sh: fixture excludes -> new package/domain paths.

Full gate from the new root: PASS=64 FAIL=0 SKIP=3.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

docs/output/casan/app-evidence/MANIFEST.md

@@ -0,0 +1,169 @@
+# CASAN OKR App Evidence Manifest
+
+Feature: `001-okr-web-app`
+Date: `2026-06-28`
+
+## Run the app
+
+Backend:
+
+```bash
+npm install
+npm run db:setup -w backend
+npm run seed -w backend
+npm run dev -w backend
+```
+
+Frontend:
+
+```bash
+VITE_API_BASE_URL=http://localhost:3000/api/v1 npm run dev -w frontend
+```
+
+Open `http://localhost:5173/login`. Seed credentials: `employee` / `Password@123`, `manager` / `Password@123`, `admin` / `Password@123`.
+
+Note: Prisma Client is the application ORM. In this Node 24 local environment, `prisma db push` returned an opaque schema-engine error even for a valid schema, so the checked-in SQLite migration SQL is applied by `backend/scripts/setup-sqlite.mjs` using Node 24 `node:sqlite`, then `prisma db seed` seeds through Prisma.
+
+## Run tests and builds
+
+```bash
+npm test -w backend
+npm run build -w backend
+npm test -w frontend
+npm run build -w frontend
+```
+
+Captured logs:
+
+- `docs/output/casan/app-evidence/backend-npm-test.log`
+- `docs/output/casan/app-evidence/backend-npm-build.log`
+- `docs/output/casan/app-evidence/frontend-npm-test.log`
+- `docs/output/casan/app-evidence/frontend-npm-build.log`
+- `docs/output/casan/app-evidence/backend-golden-deliberate-fail.log`
+- `docs/output/casan/app-evidence/backend-golden-deliberate-fail.exit`
+- `docs/output/casan/app-evidence/backend-npm-test-after-golden-restore.log`
+
+## Re-run the pipeline
+
+```bash
+node scripts/run-casan-pipeline.mjs
+```
+
+Captured run log: `docs/output/casan/app-evidence/pipeline-run.log`.
+
+## H1 Context Evidence
+
+Evidence:
+
+- `docs/output/output_logs/001-okr-web-app/pipeline-context.yaml`
+- `docs/output/output_logs/001-okr-web-app/00-boss.log.md`
+- `docs/output/ipa-docs/srs/srs-mod01-okr-management.md`
+- `docs/output/specs/001-okr-web-app/spec.md`
+- `docs/output/specs/001-okr-web-app/plan.md`
+
+Reproduce:
+
+```bash
+node scripts/run-casan-pipeline.mjs
+```
+
+## H2 Tool / Policy Evidence
+
+Evidence:
+
+- `.specify/logs/audit/tool-calls.jsonl`
+- `.specify/logs/level5/tool-registry.jsonl`
+- `.specify/logs/audit/audit.jsonl`
+
+Reproduce:
+
+```bash
+node scripts/run-casan-pipeline.mjs
+```
+
+## H3 Evaluation Evidence
+
+Evidence:
+
+- `backend/test/services.test.ts`
+- `backend/test/e2e.test.ts`
+- `backend/test/golden/objectives.manager.json`
+- `docs/output/casan/app-evidence/backend-npm-test.log`
+- `docs/output/casan/app-evidence/backend-golden-deliberate-fail.log`
+- `docs/output/casan/app-evidence/backend-golden-deliberate-fail.exit`
+
+Reproduce:
+
+```bash
+npm test -w backend
+cp backend/test/golden/objectives.manager.json /tmp/objectives.manager.json.bak
+perl -0pi -e 's/"total": 3/"total": 999/' backend/test/golden/objectives.manager.json
+npm test -w backend
+cp /tmp/objectives.manager.json.bak backend/test/golden/objectives.manager.json
+npm test -w backend
+```
+
+## H4 Security Evidence
+
+Evidence:
+
+- `.specify/logs/audit/security.jsonl`
+- `.specify/logs/trace/security-*.json`
+- `docs/output/casan/app-evidence/pipeline-run.log`
+
+Reproduce:
+
+```bash
+node scripts/run-casan-pipeline.mjs
+```
+
+## H5 Governance Evidence
+
+Evidence:
+
+- `.specify/logs/audit/audit.jsonl`
+- `.specify/logs/trace/governance-*.json`
+- `docs/output/output_logs/001-okr-web-app/reports/06-review-plan-report-attempt-1.md`
+- `docs/output/output_logs/001-okr-web-app/reports/06-review-plan-report-attempt-2.md`
+- `docs/output/output_logs/001-okr-web-app/00-boss.log.md`
+
+Reproduce:
+
+```bash
+node scripts/run-casan-pipeline.mjs
+```
+
+## H6 AgentOps Evidence
+
+Evidence:
+
+- `.specify/logs/cost/metrics.jsonl`
+- `.specify/logs/trace/agentops-*.json`
+- `docs/output/output_logs/001-okr-web-app/pipeline-context.yaml`
+
+Reproduce:
+
+```bash
+node scripts/run-casan-pipeline.mjs
+```
+
+## H7 Orchestration Evidence
+
+Evidence:
+
+- `docs/output/output_logs/001-okr-web-app/00-boss.log.md`
+- `docs/output/output_logs/001-okr-web-app/pipeline-context.yaml`
+- `.specify/logs/level5/fallback.jsonl`
+- `.specify/logs/level5/okr-plan-drift-report.json`
+- `.specify/logs/level5/rollback-transactions.jsonl`
+- `docs/output/casan/app-evidence/rollback-before.txt`
+- `docs/output/casan/app-evidence/rollback-changed.txt`
+- `docs/output/casan/app-evidence/rollback-after.txt`
+- `docs/output/casan/app-evidence/rollback-record.stdout`
+- `docs/output/casan/app-evidence/rollback-execute.stdout`
+
+Reproduce:
+
+```bash
+node scripts/run-casan-pipeline.mjs
+```

docs/output/casan/app-evidence/backend-golden-deliberate-fail.exit

@@ -0,0 +1 @@
+deliberate_golden_failure_exit_code=1

docs/output/casan/app-evidence/pipeline-summary.txt

@@ -0,0 +1 @@
+Pipeline complete. Context: docs/output/output_logs/001-okr-web-app/pipeline-context.yaml. Boss log: docs/output/output_logs/001-okr-web-app/00-boss.log.md. Last step artifacts under docs/output/output_logs/001-okr-web-app/reports.

docs/output/casan/app-evidence/rollback-after.txt

@@ -0,0 +1 @@
+original pipeline rollback content

docs/output/casan/app-evidence/rollback-before.txt

@@ -0,0 +1 @@
+original pipeline rollback content

docs/output/casan/app-evidence/rollback-changed.txt

@@ -0,0 +1 @@
+changed content that must be undone

docs/output/casan/app-evidence/rollback-execute.stdout

@@ -0,0 +1 @@
+ROLLBACK_EXECUTED transaction_id=d45f0cad-a8d4-4ae2-a02c-e9afd5a979d4

docs/output/casan/app-evidence/rollback-record.stdout

@@ -0,0 +1 @@
+ROLLBACK_RECORDED transaction_id=d45f0cad-a8d4-4ae2-a02c-e9afd5a979d4

docs/output/casan/app-evidence/rollback-target.backup.txt

@@ -0,0 +1 @@
+original pipeline rollback content

docs/output/casan/app-evidence/rollback-target.txt

@@ -0,0 +1 @@
+original pipeline rollback content