refactor(structure): promote app to repo root + remove redundant workspace cruft

Standard production layout: the OKR app (was nested under AINative_OKR_CASAN5/) is now
the repository root. No more wrapper directory.

- Promote AINative_OKR_CASAN5/* -> repo root (backend/ frontend/ packages/ apps/
  .specify/ docs/ infra/ nginx/ scripts/ + configs). Merge tool dirs: .gitea (kept the
  active deploy ci.yml, added harness-ci.yml + runbooks), .claude (agents/commands +
  launch.json), .github moved up.
- Remove redundant: 00_SUBMISSION_PACKAGE, scattered root notes (FPT_CASAN_Full.md,
  tu-tuong-casan.md, casan-tu-sinh..., casan_harness_assessment.md, source-review...,
  README_CASAN5_REFINED.md), casan-next-plans/ and optimize-docs/ (competition/planning
  artifacts — roadmap + design history preserved in git log / commit messages).
- Update all references to the old layout:
  - .gitea/workflows/{ci,harness-ci}.yml, .github/workflows/{ci,deploy}.yml:
    working-directory .; drop AINative_OKR_CASAN5/ prefix; .specify/{tests,scripts}
    -> packages/casan-harness/... (.specify/logs state kept)
  - .claude/launch.json, .gitea/*-runbook.md: path prefixes
  - CLAUDE.md, README.md: docs/input -> apps/okr/domain/input
  - policy-bundle.yaml: 8 policy paths -> packages/casan-harness/...; manifest re-signed
- secrets-scan.sh: fixture excludes -> new package/domain paths.

Full gate from the new root: PASS=64 FAIL=0 SKIP=3.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

packages/casan-harness/scripts/bash/dashboard-serve.sh

@@ -0,0 +1,72 @@
+#!/usr/bin/env bash
+set -uo pipefail
+
+# CASAN H6 — hosted AgentOps dashboard (D3).
+# Regenerates the dashboard then serves it over HTTP (dashboard-server.py)
+# with a stale-aware /healthz probe. MVP hosting: local HTTP daemon with a
+# pid file; production swaps in a real host (nginx/container) same routes.
+#
+# Usage:
+#   dashboard-serve.sh start [port]   regenerate + serve (default port 8787)
+#   dashboard-serve.sh stop           stop the running server
+#   dashboard-serve.sh status         curl /healthz of the running server
+#
+# Env: CASAN_DASHBOARD_STALE_S, CASAN_DASHBOARD_METRICS, CASAN_DASHBOARD_HTML,
+#      CASAN_AGENTOPS_DIR (pid-file location)
+#
+# Greppable outputs: DASHBOARD_HOSTED | DASHBOARD_STOPPED | DASHBOARD_NOT_RUNNING
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+source "$SCRIPT_DIR/casan-paths.sh"
+PROJECT_ROOT="$CASAN_APP_ROOT"
+AGENTOPS_DIR="${CASAN_AGENTOPS_DIR:-$CASAN_HARNESS_ROOT/agentops}"
+PID_FILE="$AGENTOPS_DIR/dashboard.pid"
+PORT_FILE="$AGENTOPS_DIR/dashboard.port"
+GENERATOR="$CASAN_HARNESS_ROOT/tests/generate-agentops-dashboard.py"
+CMD="${1:-start}"
+mkdir -p "$AGENTOPS_DIR"
+
+case "$CMD" in
+  start)
+    PORT="${2:-8787}"
+    if [[ -f "$GENERATOR" ]]; then
+      python "$GENERATOR" >/dev/null 2>&1 || true
+    fi
+    python "$SCRIPT_DIR/dashboard-server.py" "$PORT" &
+    SERVER_PID=$!
+    echo "$SERVER_PID" > "$PID_FILE"
+    echo "$PORT" > "$PORT_FILE"
+    for _ in 1 2 3 4 5 6 7 8 9 10; do
+      if curl -sS -m 2 -o /dev/null "http://127.0.0.1:$PORT/healthz" 2>/dev/null; then
+        echo "DASHBOARD_HOSTED url=http://127.0.0.1:$PORT/ healthz=http://127.0.0.1:$PORT/healthz pid=$SERVER_PID"
+        exit 0
+      fi
+      sleep 0.3
+    done
+    echo "DASHBOARD_START_FAILED port=$PORT (server did not come up)" >&2
+    kill "$SERVER_PID" 2>/dev/null
+    rm -f "$PID_FILE" "$PORT_FILE"
+    exit 1
+    ;;
+  stop)
+    if [[ -f "$PID_FILE" ]] && kill "$(cat "$PID_FILE")" 2>/dev/null; then
+      echo "DASHBOARD_STOPPED pid=$(cat "$PID_FILE")"
+      rm -f "$PID_FILE" "$PORT_FILE"
+      exit 0
+    fi
+    echo "DASHBOARD_NOT_RUNNING" >&2
+    rm -f "$PID_FILE" "$PORT_FILE"
+    exit 1
+    ;;
+  status)
+    if [[ -f "$PORT_FILE" ]]; then
+      curl -sS -m 3 "http://127.0.0.1:$(cat "$PORT_FILE")/healthz" && echo "" && exit 0
+    fi
+    echo "DASHBOARD_NOT_RUNNING" >&2
+    exit 1
+    ;;
+  *)
+    echo "Usage: dashboard-serve.sh start [port] | stop | status" >&2
+    exit 64
+    ;;
+esac