Revert "Merge pull request 'Dev' (#58) from Dev into production"

This reverts commit 821e96e011, reversing
changes made to 0ff39e9e58.

README.md

@@ -22,7 +22,6 @@ erp-monorepo/
 | `docs/10-BACKEND-PHASE1.md` | Backend spec: SRS + ER model + architecture |
 | `docs/11-BACKEND-PHASE1.md` | Backend API reference (complete req/res) |
 | `docs/20-FRONTEND.md` | Frontend user-flows + rules + validation posture |
-| `docs/40-DEPLOYMENT.md` | CI/CD pipelines, test/release environments, server runbook |
 | `Backend/PROGRESS.md`, `Frontend/PROGRESS.md` | Change checklists (git-shared) |
 
 ## Prerequisites
@@ -36,8 +35,7 @@ erp-monorepo/
 # create the database in your local Postgres first, e.g.:
 #   createdb -U postgres ERPCore   (or: CREATE DATABASE "ERPCore"; in psql)
 cd Backend/ERPCore
-# local settings are git-ignored: copy the template, then fill in your Postgres login and the GL key
-cp appsettings.Development.json.example appsettings.Development.json
+# set Username/Password in appsettings.Development.json to your local Postgres login
 dotnet ef database update
 dotnet run
 ```
@@ -48,19 +46,15 @@ Full setup (packages, folder scaffold, Program.cs wiring) is in `docs/00-CORE.md
 
 ## Run the frontend
 ```bash
-cd Frontend/erp-system
-cp .env.local.example .env.local      # BACKEND_ORIGIN=http://localhost:5224 (the Next proxy target)
+cd Frontend
+cp .env.local.example .env.local      # set NEXT_PUBLIC_API_BASE_URL=https://localhost:<port>
 npm install
 npm run dev
 ```
 
 ## Configuration & secrets
-- `appsettings.json` is committed and holds **no secrets**; environment-specific values are blank there.
-- Local: `appsettings.Development.json` (git-ignored, from the `.example`). Deployed (production): environment variables in `/etc/erpcore/erpcore.env` on the server — outside Development the API refuses to start when a required key is missing.
-- Details and the full key list: `docs/40-DEPLOYMENT.md §5`. Credentials committed in the past must be rotated (`docs/02-SECURITY.md` AR-06).
-
-## Deployment
-One workflow, `.gitea/workflows/ci-cd.yml`, does both jobs. Pull requests get checks (only the changed side is checked), and merging a PR into `production` deploys **production** (`erp.hexdive.com`) Fitness-style: publish on the server → stop → copy → start → verify, and only for the backend/frontend whose folder changed. A test environment is designed but on hold (`deploy/on-hold/`). See `docs/40-DEPLOYMENT.md`.
+- Three appsettings files: base (`appsettings.json`, placeholders only), `Development` (localhost), `Production` (env vars).
+- **Local dev only** currently. Before any shared/staging/production use, move secrets to User Secrets (dev) and environment variables (prod), keep `appsettings.Development.json` / `appsettings.Production.json` out of git, and rotate any credential ever committed.
 
 ## Tech stack
 **Backend:** .NET 10, ASP.NET Core Web API, EF Core 10, PostgreSQL (Npgsql), JWT bearer auth, Serilog, Swashbuckle/Swagger, HealthChecks. Layering: Controller → Service → Repository → UnitOfWork, DTOs at the controller boundary, FIFO in a domain service.