Feat/phase 1 code to architecture

.gitignore

@@ -35,4 +35,5 @@ CODEBASE_AUDIT_2026-03-02.md
 Q1_2026_MASTER_PLAN.md
 docs/en/codebase-audit-*.md
 docs/en/fix-log.md
-docs/en/next-level-roadmap-*.md
+docs/en/next-level-roadmap-*.md
+docs/internal

_headers

@@ -3,7 +3,7 @@
   X-Content-Type-Options: nosniff
   Referrer-Policy: strict-origin-when-cross-origin
   Permissions-Policy: camera=(), microphone=(), geolocation=()
-  Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; connect-src 'self' https: wss:; img-src 'self' data: blob: https:; font-src 'self' data:; worker-src 'self' blob:; frame-ancestors 'none';
+  Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; connect-src 'self' https://*.openai.com https://*.anthropic.com https://*.googleapis.com https://api.groq.com https://*.mistral.ai https://*.cerebras.ai https://openrouter.ai https://*.posthog.com wss://*.openflowkit.com wss://signaling.yjs.dev; img-src 'self' data: blob: https:; font-src 'self' data:; worker-src 'self' blob:; frame-ancestors 'none';
 
 /assets/*
   Cache-Control: public, max-age=31536000, immutable

assets/third-party-icons/developer/SOURCE.md

@@ -0,0 +1,10 @@
+# Developer Icons Source
+
+- Upstream: `https://github.com/xandemon/developer-icons`
+- License: MIT
+- Imported from: `/tmp/developer-icons/icons`
+- Import script: `node scripts/shape-pack/import-developer-icons.mjs /tmp/developer-icons/icons assets/third-party-icons/developer/processed`
+
+Notes:
+- Icons are grouped into local product-facing categories during import because upstream ships them in a mostly flat directory.
+- The original SVG artwork remains attributed to the upstream `developer-icons` project.