feat: architecture refactor — core layer, spreadsheet engine, envelope bidding, tests

- Add src/core/ (config, errors, events, http, observability, storage, query)
- Add src/Spreadsheet/ engine with native POI backend and Excel bridge
- Add Envelope C spreadsheet flow and tender bidding envelope modules
- Consolidate components into src/components/, remove legacy Component/ and Hooks/
- Add registration state/validation, auth session guard, profile edit modules
- Add unit tests across axios, redux, bidding, registration, encryption, core
- Add CI workflow, docs (architecture, audit, DSC API spec), keystore example
- Remove tracked keystore binary; ignore scripts.zip

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

docs/MOBILE_BID_DSC_API_SPEC.md

@@ -0,0 +1,15 @@
+# Mobile bid encryption contract
+
+The mobile client uses the server-issued envelope key `K` for all bid
+submissions. For text values, encrypt with AES-128/ECB/PKCS5 using the first
+16 bytes of SHA-256(`K`) and send Base64 ciphertext. For the Envelope-C BOQ,
+encrypt the raw workbook bytes with AES-128/ECB/PKCS5 using the first 16 bytes
+of SHA-1(`K`) and upload the raw ciphertext bytes as the multipart `file`.
+
+The same `K` must be sent as `randomKeyGenerated` and RSA-wrapped with every
+officer/contractor public key in `saveEnvelopesOfficersDetailsResDTO`.
+
+Envelope-C `requestDto` includes `deviceType: "Mobile"`, `fieldValue`,
+`fieldValueInWord`, `hashValue` (SHA-256 of the unencrypted workbook bytes),
+`fileName`, and the wrapped officer keys. The workbook editor preserves the
+source workbook structure and only applies permitted cell edits.