refactor(structure): promote app to repo root + remove redundant workspace cruft

Standard production layout: the OKR app (was nested under AINative_OKR_CASAN5/) is now
the repository root. No more wrapper directory.

- Promote AINative_OKR_CASAN5/* -> repo root (backend/ frontend/ packages/ apps/
  .specify/ docs/ infra/ nginx/ scripts/ + configs). Merge tool dirs: .gitea (kept the
  active deploy ci.yml, added harness-ci.yml + runbooks), .claude (agents/commands +
  launch.json), .github moved up.
- Remove redundant: 00_SUBMISSION_PACKAGE, scattered root notes (FPT_CASAN_Full.md,
  tu-tuong-casan.md, casan-tu-sinh..., casan_harness_assessment.md, source-review...,
  README_CASAN5_REFINED.md), casan-next-plans/ and optimize-docs/ (competition/planning
  artifacts — roadmap + design history preserved in git log / commit messages).
- Update all references to the old layout:
  - .gitea/workflows/{ci,harness-ci}.yml, .github/workflows/{ci,deploy}.yml:
    working-directory .; drop AINative_OKR_CASAN5/ prefix; .specify/{tests,scripts}
    -> packages/casan-harness/... (.specify/logs state kept)
  - .claude/launch.json, .gitea/*-runbook.md: path prefixes
  - CLAUDE.md, README.md: docs/input -> apps/okr/domain/input
  - policy-bundle.yaml: 8 policy paths -> packages/casan-harness/...; manifest re-signed
- secrets-scan.sh: fixture excludes -> new package/domain paths.

Full gate from the new root: PASS=64 FAIL=0 SKIP=3.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

docs/output/casan/phase3-preflight.md

@@ -0,0 +1,138 @@
+# CASAN Phase 3 Preflight Report
+
+Date: 2026-06-30
+Repo root: `/Users/thanhnguyen/Documents/AI/HarnessHkt/Harness_Hakathon/Output_CASAN5_REFINED/AINative_OKR_CASAN5`
+
+## Evidence Files
+
+- `docs/output/casan/phase3-evidence/preflight/git.txt`
+- `docs/output/casan/phase3-evidence/preflight/mac-toolchain.txt`
+- `docs/output/casan/phase3-evidence/preflight/cloud-env-presence.txt`
+- `docs/output/casan/phase3-evidence/preflight/linux-server.txt`
+- `docs/output/casan/phase3-evidence/preflight/ollama-mac.txt`
+- `docs/output/casan/phase3-evidence/preflight/ollama-linux-via-tunnel.txt`
+- `docs/output/casan/phase3-evidence/preflight/ollama-linux-via-tunnel-generate.json`
+- `docs/output/casan/phase3-evidence/preflight/npm-audit-high.txt`
+- `docs/output/casan/phase3-evidence/preflight/npm-audit-high.exit`
+- `docs/output/casan/phase3-evidence/preflight/npm-audit.json`
+- `docs/output/casan/phase3-evidence/preflight/npm-audit-json.exit`
+- `docs/output/casan/phase3-evidence/preflight/npm-test.txt`
+- `docs/output/casan/phase3-evidence/preflight/npm-build.txt`
+
+## Git
+
+Status: git repository detected.
+
+- `git rev-parse --is-inside-work-tree`: `true`
+- Branch: `main`
+- Current untracked files include:
+  - `docs/output/casan/phase3-evidence/`
+  - `docs/output/casan/phase3-push-to-90-plan.md`
+  - `docs/output/casan/phase3-security-hardening-plan.md`
+
+Implication: Phase 3 can use git-based diffs/commits if desired, but untracked evidence and plan files should be handled intentionally.
+
+## Mac Runtime
+
+- macOS: 26.5.1, arm64
+- Node: v24.12.0
+- npm: 11.7.0
+- Python: 3.9.0
+- Bash: 3.2.57
+- curl: 8.7.1
+
+## Linux Server Runtime
+
+SSH target used by operator: `thanh nv` account on `192.168.1.5`.
+
+- OS: Ubuntu 26.04 LTS
+- Kernel: `7.0.0-14-generic`
+- Architecture: x86_64
+- Node: v22.23.1
+- npm: 11.17.0
+- Python: 3.14.4
+- Ollama: 0.30.11
+
+## Model Availability
+
+Cloud model env on Mac:
+
+- `CASAN_MODEL_PRIMARY=unset`
+- `CASAN_MODEL_SECONDARY=unset`
+- `ANTHROPIC_API_KEY=unset`
+- `OPENAI_API_KEY=unset`
+
+Cloud status: unavailable for current preflight.
+
+Local model strategy:
+
+- Ollama is used on Linux server, not directly on Mac.
+- Mac reaches Linux Ollama through SSH tunnel exposed as `http://127.0.0.1:11434`.
+- Primary local model: `ollama:ornith:9b`
+- Available Linux Ollama models:
+  - `ornith:9b`, digest `a75697c145891910e312c95e4a9fc1ccb8653e5ef543b23b0403a4665b82fd91`
+  - `gemma4:12b`, digest `4eb23ef187e2c5462566d6a1d3bbbc2f1346d0b4327cbb66d58fffbcc9b2b05c`
+
+Generate smoke test:
+
+- `ollama-linux-via-tunnel-generate.json` returned response `OK`.
+- Real usage fields were present:
+  - `prompt_eval_count`: 72
+  - `eval_count`: 27
+  - `total_duration`: 10540918012 ns
+
+## npm Audit
+
+`npm audit --workspaces --audit-level=high` exit code: `1`.
+
+Audit summary from JSON:
+
+- Total vulnerabilities: 12
+- High: 5
+- Moderate: 7
+- Critical: 0
+
+High-risk packages reported include:
+
+- `multer <=2.1.1`, via `@nestjs/platform-express`
+- `tar <=7.5.15`, via `@mapbox/node-pre-gyp`
+
+Implication: Phase 3 supply-chain work should not claim green until high vulnerabilities are addressed or a documented accepted-risk decision is made.
+
+## Baseline Test / Build
+
+Current captured baseline is blocked:
+
+- `npm test`: failed
+- `npm run build`: failed
+- Immediate cause in both logs: `sh: prisma: command not found`
+
+This means current local dependency state is incomplete or PATH/package installation is inconsistent at the time of preflight. Before Phase 3 implementation claims any pass state, rerun:
+
+```bash
+npm install
+npm test
+npm run build
+```
+
+and capture refreshed logs under `docs/output/casan/phase3-evidence/preflight/`.
+
+## Preflight Decision
+
+Proceed with Phase 3 Wave 1 only after resolving the local dependency issue or explicitly marking app baseline as blocked.
+
+Recommended environment for Wave 1:
+
+```bash
+export CASAN_MODEL_BACKEND=local
+export CASAN_MODEL_PRIMARY=ollama:ornith:9b
+export CASAN_MODEL_SECONDARY=ollama:ornith:9b
+```
+
+Required tunnel while running model-router tests on Mac:
+
+```bash
+ssh -N -L 11434:127.0.0.1:11434 thanhnv@192.168.1.5
+```
+
+No cloud-backed judge/classifier should be claimed until Anthropic or OpenAI credentials are actually present.