refactor: harden production readiness and split ERP services

[cb8010d6]

Summary

This draft PR publishes the current OneERP production-readiness and refactoring branch for review and CI validation.

It intentionally stays in draft state because the branch is large and must not be treated as ready to merge until GitHub Actions, Docker/runtime smoke checks, restore drill, and business acceptance are all reviewed.

What changed

• Hardened production safety baselines: auth/session/CSRF, upload validation, AI SQL read-only checks, startup config validation, safer AI provider URL handling, non-root containers, safer Compose defaults, and dependency security gating.
• Split large ERP services behind existing facade APIs: Finance, Purchase, and Inventory query/report/read-model services were extracted while preserving controller-facing method signatures.
• Added release hardening gates: dependency high/critical audit gate, remaining-risk preflight, enum dirty-data SQL/report tooling, Compose config validation, and deploy workflow release preflight before GHCR image publishing.
• Updated operational scripts and documentation: production readiness docs, go-live checklist, HA-lite runbook, backup/restore scripts, deploy checks, smoke checks, and bilingual README improvements.
• Improved frontend and workflow coverage across mobile layouts, finance/purchase/inventory workbenches, AI provider settings, and acceptance scripts.

Latest validation

Latest local validation on this branch:

• npm run validate passed with required local validation env vars set.
• npm run audit:security passed. Root/API/Web report 0 vulnerabilities; mobile still reports moderate Expo/uuid-chain advisories, documented as a mobile-upgrade follow-up because the production gate currently blocks high/critical.
• npm run risk:preflight passed and generated enum dirty-data SQL.
• npm run compose:config passed for dev, easy, HA-lite, and image-based production Compose files, with no literal third-party :latest runtime images.
• Secret scan for known leaked-key patterns returned no matches.

Latest GitHub checks on this PR head are green:

• CI / commitlint
• CI / validate
• CodeQL / Analyze (actions)
• CodeQL / Analyze (javascript-typescript)

Important caveats

• This PR does not claim OneERP is production-ready yet.
• Remaining gates include real Docker stack startup on a running Docker daemon, production-like smoke tests, restore drill, real product screenshots, GitHub repository presentation cleanup, and business acceptance sign-off.
• Prisma enum migration, Decimal precision migration, and write-operation service splits are intentionally out of scope for this PR and should stay on separate analysis-first branches.
• Mobile dependency moderate advisories remain and should be handled in a dedicated Expo/React Native upgrade verification pass before serious mobile production use.