feat: architecture refactor — core layer, spreadsheet engine, envelope bidding, tests

- Add src/core/ (config, errors, events, http, observability, storage, query)
- Add src/Spreadsheet/ engine with native POI backend and Excel bridge
- Add Envelope C spreadsheet flow and tender bidding envelope modules
- Consolidate components into src/components/, remove legacy Component/ and Hooks/
- Add registration state/validation, auth session guard, profile edit modules
- Add unit tests across axios, redux, bidding, registration, encryption, core
- Add CI workflow, docs (architecture, audit, DSC API spec), keystore example
- Remove tracked keystore binary; ignore scripts.zip

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

sonar-project.properties

@@ -4,10 +4,13 @@ sonar.projectName=ProcureLinc
 sonar.projectVersion=1.0
 
 # Source configuration
-sonar.sources=.
+sonar.sources=src
+sonar.exclusions=**/node_modules/**,**/android/**,**/ios/**,**/__tests__/**,**/assets/**,**/lottie/**
 
 # SonarQube server
 sonar.host.url=http://localhost:9000
 
-# Authentication token
-sonar.login=sqp_da89e447c964b6e91e142777097e25fa2f17a1cc
+# Authentication: NEVER commit a token here.
+# Pass it via the environment instead: SONAR_TOKEN=... npx sonar-scanner
+# The previously committed token must be revoked in SonarQube
+# (Administration > Security > Users > Tokens).