rename(phase 3): compose/DB/infra names + stray code refs capakraken → nexus

- docker-compose.yml / .prod.yml / .ci.yml: project names, POSTGRES_DB/USER,
  pg_isready, DATABASE_URL, volume names (nexus_pgdata, nexus_prod_*)
- .github/workflows/ci.yml: POSTGRES_PASSWORD, pg_isready, psql credentials,
  GRANT statements, POSTGRES_PASSWORD=nexus_dev for Docker Deploy job
- scripts/db-target-guard.mjs: expectedDatabase default, NEXUS_EXPECTED_DB_NAME
- scripts/prisma-with-env.mjs, e2e/test-server.mjs: env-var rename
- packages/db/src/safe-destructive-env.ts + reset-dispo-import.ts: DB name set
- packages/db/src/destructive-db-guard.ts: PROTECTED_DATABASE_NAMES → "nexus"
- packages/db/src/destructive-db-guard.test.ts: all fixture DB names + comments
- .env.example, tooling/deploy/deploy.env.example: DATABASE_URL, image refs
- packages/api: Redis channel/key prefixes (rbac-invalidate, sse, ratelimit),
  logger service name, app-base-url log prefix
- E2E: DB container names, localStorage/sessionStorage keys, email domains
- scripts: architecture-guardrails filter, export/import-dev-seed defaults,
  harden-postgres defaults, start.sh pg_isready, worktree-hygiene fixture
- tooling/migrate/rename-to-nexus.sh: new maintenance-window cutover script

Only intentional capakraken survivor: anonymization.ts DEFAULT_ANONYMIZATION_SEED
(functional cryptographic constant — changing it would invalidate stored aliases).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

apps/web/e2e/dev-system/helpers.ts

@@ -26,7 +26,7 @@ export async function signOut(page: Page) {
   await page.goto("/dashboard"); // land on any authenticated page for cookie context
   await page.evaluate(async () => {
     const csrfRes = await fetch("/api/auth/csrf");
-    const { csrfToken } = await csrfRes.json() as { csrfToken: string };
+    const { csrfToken } = (await csrfRes.json()) as { csrfToken: string };
     await fetch("/api/auth/signout", {
       method: "POST",
       headers: { "Content-Type": "application/x-www-form-urlencoded" },
@@ -62,11 +62,9 @@ function decodeMimeBody(body: string, encoding: string | undefined): string {
   const enc = (encoding ?? "").toLowerCase().trim();
   if (enc === "quoted-printable") {
     return body
-      .replace(/=\r\n/g, "")   // soft line break (CRLF)
-      .replace(/=\n/g, "")      // soft line break (LF)
-      .replace(/=([0-9A-Fa-f]{2})/g, (_, hex: string) =>
-        String.fromCharCode(parseInt(hex, 16)),
-      );
+      .replace(/=\r\n/g, "") // soft line break (CRLF)
+      .replace(/=\n/g, "") // soft line break (LF)
+      .replace(/=([0-9A-Fa-f]{2})/g, (_, hex: string) => String.fromCharCode(parseInt(hex, 16)));
   }
   if (enc === "base64") {
     return Buffer.from(body.replace(/\s/g, ""), "base64").toString("utf8");
@@ -90,7 +88,10 @@ export async function clearMailhog(): Promise<void> {
  */
 export async function getLatestEmailTo(
   address: string,
-  { timeoutMs = 10_000, pollIntervalMs = 500 }: { timeoutMs?: number; pollIntervalMs?: number } = {},
+  {
+    timeoutMs = 10_000,
+    pollIntervalMs = 500,
+  }: { timeoutMs?: number; pollIntervalMs?: number } = {},
 ): Promise<{ subject: string; body: string; html: string }> {
   const deadline = Date.now() + timeoutMs;
 
@@ -144,7 +145,9 @@ export function extractUrlFromEmail(
   pathPrefix: string,
 ): string {
   const text = email.html || email.body;
-  const match = text.match(new RegExp(`https?://[^\\s"'<>]*${pathPrefix.replace("/", "\\/")}[^\\s"'<>]*`));
+  const match = text.match(
+    new RegExp(`https?://[^\\s"'<>]*${pathPrefix.replace("/", "\\/")}[^\\s"'<>]*`),
+  );
   if (!match?.[0]) {
     throw new Error(`No URL with prefix "${pathPrefix}" found in email`);
   }
@@ -166,10 +169,10 @@ export async function resetPasswordViaApi(
   // argon2id hashes use base64 chars only — safe inside a SQL single-quoted string
   // Column name is camelCase (Prisma default) — must be double-quoted in SQL
   const sql = `UPDATE users SET "passwordHash" = '${passwordHash}' WHERE email = '${email}';`;
-  execSync(
-    `docker exec -i capakraken-postgres-1 psql -U capakraken -d capakraken`,
-    { input: sql, encoding: "utf8" },
-  );
+  execSync(`docker exec -i nexus-postgres-1 psql -U nexus -d nexus`, {
+    input: sql,
+    encoding: "utf8",
+  });
 }
 
 // ── tRPC helpers ───────────────────────────────────────────────────────────────