rename(phase 3): compose/DB/infra names + stray code refs capakraken → nexus

- docker-compose.yml / .prod.yml / .ci.yml: project names, POSTGRES_DB/USER,
  pg_isready, DATABASE_URL, volume names (nexus_pgdata, nexus_prod_*)
- .github/workflows/ci.yml: POSTGRES_PASSWORD, pg_isready, psql credentials,
  GRANT statements, POSTGRES_PASSWORD=nexus_dev for Docker Deploy job
- scripts/db-target-guard.mjs: expectedDatabase default, NEXUS_EXPECTED_DB_NAME
- scripts/prisma-with-env.mjs, e2e/test-server.mjs: env-var rename
- packages/db/src/safe-destructive-env.ts + reset-dispo-import.ts: DB name set
- packages/db/src/destructive-db-guard.ts: PROTECTED_DATABASE_NAMES → "nexus"
- packages/db/src/destructive-db-guard.test.ts: all fixture DB names + comments
- .env.example, tooling/deploy/deploy.env.example: DATABASE_URL, image refs
- packages/api: Redis channel/key prefixes (rbac-invalidate, sse, ratelimit),
  logger service name, app-base-url log prefix
- E2E: DB container names, localStorage/sessionStorage keys, email domains
- scripts: architecture-guardrails filter, export/import-dev-seed defaults,
  harden-postgres defaults, start.sh pg_isready, worktree-hygiene fixture
- tooling/migrate/rename-to-nexus.sh: new maintenance-window cutover script

Only intentional capakraken survivor: anonymization.ts DEFAULT_ANONYMIZATION_SEED
(functional cryptographic constant — changing it would invalidate stored aliases).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

docker-compose.yml

@@ -1,4 +1,4 @@
-name: capakraken
+name: nexus
 
 services:
   postgres:
@@ -6,8 +6,8 @@ services:
     ports:
       - "5433:5432"
     environment:
-      POSTGRES_DB: capakraken
-      POSTGRES_USER: capakraken
+      POSTGRES_DB: nexus
+      POSTGRES_USER: nexus
       POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD in .env (any non-empty value for local dev)}
     command: >
       postgres
@@ -17,9 +17,9 @@ services:
       -c log_line_prefix='%t [%p] %u@%d '
       -c log_min_duration_statement=1000
     volumes:
-      - capakraken_pgdata:/var/lib/postgresql/data
+      - nexus_pgdata:/var/lib/postgresql/data
     healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U capakraken -d capakraken"]
+      test: ["CMD-SHELL", "pg_isready -U nexus -d nexus"]
       interval: 5s
       timeout: 3s
       retries: 5
@@ -61,7 +61,7 @@ services:
       # Always use the Docker-internal service name. The host-level DATABASE_URL
       # (localhost:5433) must not bleed into the container where "localhost" is
       # the container itself, not the host.
-      DATABASE_URL: postgresql://capakraken:${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD}@postgres:5432/capakraken
+      DATABASE_URL: postgresql://nexus:${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD}@postgres:5432/nexus
       REDIS_URL: redis://redis:6379
       NEXTAUTH_URL: ${NEXTAUTH_URL:?NEXTAUTH_URL must be set (e.g. https://your-domain.com)}
       NEXTAUTH_SECRET: ${NEXTAUTH_SECRET:?set NEXTAUTH_SECRET}
@@ -90,9 +90,9 @@ services:
     volumes:
       - .:/app
       # Named volumes mask the bind-mount for generated/installed artefacts.
-      # Named (not anonymous) so they can be selectively removed: docker volume rm capakraken_node_modules
-      - capakraken_node_modules:/app/node_modules
-      - capakraken_next:/app/apps/web/.next
+      # Named (not anonymous) so they can be selectively removed: docker volume rm nexus_node_modules
+      - nexus_node_modules:/app/node_modules
+      - nexus_next:/app/apps/web/.next
     profiles:
       - full
 
@@ -101,18 +101,18 @@ services:
     ports:
       - "${POSTGRES_TEST_PORT:-5434}:5432"
     environment:
-      POSTGRES_DB: capakraken_test
-      POSTGRES_USER: capakraken
-      POSTGRES_PASSWORD: capakraken_test
+      POSTGRES_DB: nexus_test
+      POSTGRES_USER: nexus
+      POSTGRES_PASSWORD: nexus_test
     tmpfs:
       - /var/lib/postgresql/data
     profiles:
       - test
 
 volumes:
-  capakraken_pgdata:
-    name: capakraken_pgdata
-  capakraken_node_modules:
-    name: capakraken_node_modules
-  capakraken_next:
-    name: capakraken_next
+  nexus_pgdata:
+    name: nexus_pgdata
+  nexus_node_modules:
+    name: nexus_node_modules
+  nexus_next:
+    name: nexus_next