rename(phase 1): CapaKraken → Nexus across code, UI, docs, CI

- @capakraken/* → @nexus/* across 12 packages (root + 11 workspaces),
  1551 import lines migrated via codemod
- User-visible brand strings renamed (emails, page titles, PWA
  manifest, mobile header, MFA backup-codes header, tooltips, signin
  page, invite page, weekly digest, install prompt)
- TOTP issuer "CapaKraken" → "Nexus" (existing secrets still valid;
  re-enrollment relabels them in users' authenticator apps)
- Function rename: assertCapaKrakenDbTarget → assertNexusDbTarget
- LocalStorage migration shim in apps/web/src/app/layout.tsx copies
  capakraken_* → nexus_* on first load (guarded by nexus_migrated_v1
  sentinel; runs once per browser, then never again)
- Service-worker cache name capakraken-v2 → nexus-v2 with one-time
  caches.delete('capakraken-v2') from the same shim
- Email-domain fixtures @capakraken.{dev,app} → @nexus.{dev,app} in
  seed data, e2e specs, SMTP default fallback
- Dockerfile.dev / Dockerfile.prod / all .github/workflows/*.yml
  pnpm --filter @capakraken/* → @nexus/*
- README, CLAUDE.md, LEARNINGS.md, all docs/*.md, .env.example,
  tooling/deploy/.env.production.example brand sweep

Phase 1 deliberately leaves untouched (handled in Phase 3 cutover):
- PostgreSQL DB name "capakraken" and POSTGRES_USER "capakraken"
- Volume names capakraken_pgdata etc.
- Compose project name "capakraken" / "capakraken-prod"
- db-target-guard default expectedDatabase
- env-var CAPAKRAKEN_EXPECTED_DB_NAME
- Container DNS names in docker-compose.ci.yml

Quality gates green: pnpm typecheck (7/7), pnpm test:unit (7/7),
pnpm lint (0 errors), check:exports/imports/architecture all pass.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

docs/ci-cd-manual.md

@@ -1,8 +1,8 @@
-# CapaKraken CI/CD Manual
+# Nexus CI/CD Manual
 
 ## Overview
 
-This is the operational runbook for the canonical CapaKraken delivery path:
+This is the operational runbook for the canonical Nexus delivery path:
 
 1. CI validates every PR.
 2. Every push to `main` publishes immutable release images.
@@ -12,7 +12,7 @@ This is the operational runbook for the canonical CapaKraken delivery path:
 
 ## 1. CI Gate
 
-The merge gate is [ci.yml](/home/hartmut/Documents/Copilot/capakraken/.github/workflows/ci.yml).
+The merge gate is [ci.yml](/home/hartmut/Documents/Copilot/nexus/.github/workflows/ci.yml).
 
 It covers:
 
@@ -28,15 +28,15 @@ Before merging, all required checks must pass.
 Useful local commands:
 
 ```bash
-pnpm --filter @capakraken/web exec tsc --project tsconfig.typecheck.json --noEmit
+pnpm --filter @nexus/web exec tsc --project tsconfig.typecheck.json --noEmit
 pnpm lint
 pnpm test:unit
-pnpm --filter @capakraken/web exec next build
+pnpm --filter @nexus/web exec next build
 ```
 
 ## 2. Image Release
 
-[release-image.yml](/home/hartmut/Documents/Copilot/capakraken/.github/workflows/release-image.yml) runs automatically on every push to `main`.
+[release-image.yml](/home/hartmut/Documents/Copilot/nexus/.github/workflows/release-image.yml) runs automatically on every push to `main`.
 
 It publishes:
 
@@ -47,7 +47,7 @@ The workflow is also callable manually if a rebuild or tag override is needed.
 
 ## 3. Host Bootstrap
 
-Each deploy target should have a dedicated directory such as `/opt/capakraken` containing:
+Each deploy target should have a dedicated directory such as `/opt/nexus` containing:
 
 ```text
 docker-compose.prod.yml
@@ -58,8 +58,8 @@ tooling/deploy/deploy-compose.sh
 
 Use these examples from the repo:
 
-- [tooling/deploy/.env.production.example](/home/hartmut/Documents/Copilot/capakraken/tooling/deploy/.env.production.example)
-- [tooling/deploy/deploy.env.example](/home/hartmut/Documents/Copilot/capakraken/tooling/deploy/deploy.env.example)
+- [tooling/deploy/.env.production.example](/home/hartmut/Documents/Copilot/nexus/tooling/deploy/.env.production.example)
+- [tooling/deploy/deploy.env.example](/home/hartmut/Documents/Copilot/nexus/tooling/deploy/deploy.env.example)
 
 Important host-side rules:
 
@@ -79,16 +79,16 @@ openssl rand -base64 32
 Standard path:
 
 1. merge to `main`
-2. wait for [release-image.yml](/home/hartmut/Documents/Copilot/capakraken/.github/workflows/release-image.yml) to publish `sha-<commit>`
-3. run [deploy-staging.yml](/home/hartmut/Documents/Copilot/capakraken/.github/workflows/deploy-staging.yml) with that tag
+2. wait for [release-image.yml](/home/hartmut/Documents/Copilot/nexus/.github/workflows/release-image.yml) to publish `sha-<commit>`
+3. run [deploy-staging.yml](/home/hartmut/Documents/Copilot/nexus/.github/workflows/deploy-staging.yml) with that tag
 
 The workflow uploads:
 
-- [docker-compose.prod.yml](/home/hartmut/Documents/Copilot/capakraken/docker-compose.prod.yml)
-- [tooling/deploy](/home/hartmut/Documents/Copilot/capakraken/tooling/deploy/README.md)
+- [docker-compose.prod.yml](/home/hartmut/Documents/Copilot/nexus/docker-compose.prod.yml)
+- [tooling/deploy](/home/hartmut/Documents/Copilot/nexus/tooling/deploy/README.md)
 - a short-lived `deploy.env`
 
-On the host, [deploy-compose.sh](/home/hartmut/Documents/Copilot/capakraken/tooling/deploy/deploy-compose.sh):
+On the host, [deploy-compose.sh](/home/hartmut/Documents/Copilot/nexus/tooling/deploy/deploy-compose.sh):
 
 1. validates the rendered compose file
 2. pulls `APP_IMAGE` and `MIGRATOR_IMAGE`
@@ -101,7 +101,7 @@ On the host, [deploy-compose.sh](/home/hartmut/Documents/Copilot/capakraken/tool
 
 After staging is accepted:
 
-1. run [deploy-prod.yml](/home/hartmut/Documents/Copilot/capakraken/.github/workflows/deploy-prod.yml)
+1. run [deploy-prod.yml](/home/hartmut/Documents/Copilot/nexus/.github/workflows/deploy-prod.yml)
 2. use the exact same `sha-<commit>` tag
 3. verify `GET /api/ready`
 
@@ -151,10 +151,10 @@ Schema changes still need expand-and-contract discipline for rollback safety.
 Run the failing command locally:
 
 ```bash
-pnpm --filter @capakraken/web exec tsc --project tsconfig.typecheck.json --noEmit
+pnpm --filter @nexus/web exec tsc --project tsconfig.typecheck.json --noEmit
 pnpm lint
 pnpm test:unit
-pnpm --filter @capakraken/web exec next build
+pnpm --filter @nexus/web exec next build
 ```
 
 ### Deploy fails before container start