feat(wave5): CI/CD pipeline + Vault KMS + OKR deploy to port 80/3001

Infrastructure (H3 CI gate, H5 KMS):
- Gitea Actions enabled (GITEA__actions__ENABLED=true)
- act_runner: Docker-outside-of-Docker for deploy job
- Vault Transit RSA-2048 signing keys (casan-audit-key, casan-policy-key)

Vault KMS scripts (H5 governance):
- .specify/scripts/bash/vault-kms.sh — sign/verify/pubkey/ensure-key
- .specify/scripts/bash/sign-audit-head.sh — sign audit chain via Vault
- Updated sign-policy-bundle.sh — Vault path + local fallback
- Updated security-gate.sh — KMS gate added (PASS=11 FAIL=0)

OKR app deployment (port 80/3001):
- Dockerfile.backend — node:22-slim (node:sqlite requires Node 22)
- Dockerfile.frontend — node:20-alpine build + nginx:alpine runtime
- nginx/nginx.conf — React SPA + /api/v1/* proxy to okr-backend:3001
- backend/entrypoint.sh — auto init DB on first run + seed
- .dockerignore

CI pipeline (.gitea/workflows/ci.yml):
- Job 1: Vitest frontend tests (H3)
- Job 2: CASAN security gate + Vault KMS signing (H4/H5)
- Job 3: Deploy OKR → port 80 (runs on push to main after tests pass)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

AINative_OKR_CASAN5/.specify/scripts/bash/sign-policy-bundle.sh

@@ -65,12 +65,24 @@ PY
 
 if [[ "$MODE" == "sign" ]]; then
   generate_manifest
-  if [[ ! -f "$PRIVATE_KEY" ]]; then
-    openssl genrsa -out "$PRIVATE_KEY" 2048 >/dev/null 2>&1
-    openssl rsa -in "$PRIVATE_KEY" -pubout -out "$PUBLIC_KEY" >/dev/null 2>&1
+
+  if [[ -n "${VAULT_ADDR:-}" && -n "${VAULT_TOKEN:-}" ]] && \
+     curl -sf "$VAULT_ADDR/v1/sys/health" >/dev/null 2>&1; then
+    # ── KMS path: sign via HashiCorp Vault Transit (key never stored on disk) ──
+    VAULT_KMS="$SCRIPT_DIR/vault-kms.sh"
+    bash "$VAULT_KMS" enable-transit
+    bash "$VAULT_KMS" sign   "$MANIFEST" "$SIGNATURE"  "casan-policy-key"
+    bash "$VAULT_KMS" pubkey "$PUBLIC_KEY"              "casan-policy-key"
+    echo "POLICY_BUNDLE_SIGNED manifest=$MANIFEST signature=$SIGNATURE public_key=$PUBLIC_KEY key_backend=vault-kms"
+  else
+    # ── Fallback: local key file (dev / no Vault) ─────────────────────────────
+    if [[ ! -f "$PRIVATE_KEY" ]]; then
+      openssl genrsa -out "$PRIVATE_KEY" 2048 >/dev/null 2>&1
+      openssl rsa -in "$PRIVATE_KEY" -pubout -out "$PUBLIC_KEY" >/dev/null 2>&1
+    fi
+    openssl dgst -sha256 -sign "$PRIVATE_KEY" -out "$SIGNATURE" "$MANIFEST"
+    echo "POLICY_BUNDLE_SIGNED manifest=$MANIFEST signature=$SIGNATURE public_key=$PUBLIC_KEY key_backend=local-file"
   fi
-  openssl dgst -sha256 -sign "$PRIVATE_KEY" -out "$SIGNATURE" "$MANIFEST"
-  echo "POLICY_BUNDLE_SIGNED manifest=$MANIFEST signature=$SIGNATURE public_key=$PUBLIC_KEY"
   exit 0
 fi