rename(phase 1): CapaKraken → Nexus across code, UI, docs, CI

- @capakraken/* → @nexus/* across 12 packages (root + 11 workspaces),
  1551 import lines migrated via codemod
- User-visible brand strings renamed (emails, page titles, PWA
  manifest, mobile header, MFA backup-codes header, tooltips, signin
  page, invite page, weekly digest, install prompt)
- TOTP issuer "CapaKraken" → "Nexus" (existing secrets still valid;
  re-enrollment relabels them in users' authenticator apps)
- Function rename: assertCapaKrakenDbTarget → assertNexusDbTarget
- LocalStorage migration shim in apps/web/src/app/layout.tsx copies
  capakraken_* → nexus_* on first load (guarded by nexus_migrated_v1
  sentinel; runs once per browser, then never again)
- Service-worker cache name capakraken-v2 → nexus-v2 with one-time
  caches.delete('capakraken-v2') from the same shim
- Email-domain fixtures @capakraken.{dev,app} → @nexus.{dev,app} in
  seed data, e2e specs, SMTP default fallback
- Dockerfile.dev / Dockerfile.prod / all .github/workflows/*.yml
  pnpm --filter @capakraken/* → @nexus/*
- README, CLAUDE.md, LEARNINGS.md, all docs/*.md, .env.example,
  tooling/deploy/.env.production.example brand sweep

Phase 1 deliberately leaves untouched (handled in Phase 3 cutover):
- PostgreSQL DB name "capakraken" and POSTGRES_USER "capakraken"
- Volume names capakraken_pgdata etc.
- Compose project name "capakraken" / "capakraken-prod"
- db-target-guard default expectedDatabase
- env-var CAPAKRAKEN_EXPECTED_DB_NAME
- Container DNS names in docker-compose.ci.yml

Quality gates green: pnpm typecheck (7/7), pnpm test:unit (7/7),
pnpm lint (0 errors), check:exports/imports/architecture all pass.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

packages/db/src/destructive-db-guard.test.ts

@@ -1,7 +1,7 @@
 import assert from "node:assert/strict";
 import test from "node:test";
 import { assertDestructiveDbAllowed } from "./destructive-db-guard.js";
-import { assertCapaKrakenDbTarget, assertSafeSeedTarget } from "./safe-destructive-env.js";
+import { assertNexusDbTarget, assertSafeSeedTarget } from "./safe-destructive-env.js";
 
 const ORIGINAL_ENV = { ...process.env };
 
@@ -46,10 +46,11 @@ test("assertDestructiveDbAllowed rejects protected live database names even if a
   });
 
   assert.throws(
-    () => assertDestructiveDbAllowed({
-      commandName: "db:test",
-      allowedDatabaseNames: ["capakraken"],
-    }),
+    () =>
+      assertDestructiveDbAllowed({
+        commandName: "db:test",
+        allowedDatabaseNames: ["capakraken"],
+      }),
     /explicitly protected/u,
   );
 });
@@ -62,10 +63,11 @@ test("assertDestructiveDbAllowed rejects missing confirmation", () => {
   });
 
   assert.throws(
-    () => assertDestructiveDbAllowed({
-      commandName: "db:test",
-      allowedDatabaseNames: ["capakraken_e2e"],
-    }),
+    () =>
+      assertDestructiveDbAllowed({
+        commandName: "db:test",
+        allowedDatabaseNames: ["capakraken_e2e"],
+      }),
     /CONFIRM_DESTRUCTIVE_DB_NAME=capakraken_e2e/u,
   );
 });
@@ -78,10 +80,11 @@ test("assertDestructiveDbAllowed rejects missing destructive allow flag", () =>
   });
 
   assert.throws(
-    () => assertDestructiveDbAllowed({
-      commandName: "db:test",
-      allowedDatabaseNames: ["capakraken_ci"],
-    }),
+    () =>
+      assertDestructiveDbAllowed({
+        commandName: "db:test",
+        allowedDatabaseNames: ["capakraken_ci"],
+      }),
     /ALLOW_DESTRUCTIVE_DB_TOOLS=true/u,
   );
 });
@@ -93,40 +96,34 @@ test("assertSafeSeedTarget rejects unexpected legacy disposable databases", () =
     CONFIRM_DESTRUCTIVE_DB_NAME: "legacy_test",
   });
 
-  assert.throws(
-    () => assertSafeSeedTarget("db:seed"),
-    /not in the destructive-tool allowlist/u,
-  );
+  assert.throws(() => assertSafeSeedTarget("db:seed"), /not in the destructive-tool allowlist/u);
 });
 
-test("assertCapaKrakenDbTarget accepts non-destructive capakraken targets", () => {
+test("assertNexusDbTarget accepts non-destructive capakraken targets", () => {
   setEnv({
     DATABASE_URL: "postgresql://tester:secret@localhost:5432/capakraken_dev",
   });
 
-  const target = assertCapaKrakenDbTarget("db:seed:holidays");
+  const target = assertNexusDbTarget("db:seed:holidays");
 
   assert.equal(target.databaseName, "capakraken_dev");
 });
 
-test("assertCapaKrakenDbTarget rejects legacy non-capakraken targets", () => {
+test("assertNexusDbTarget rejects legacy non-capakraken targets", () => {
   setEnv({
     DATABASE_URL: "postgresql://tester:secret@localhost:5432/legacy_non_capakraken",
   });
 
-  assert.throws(
-    () => assertCapaKrakenDbTarget("db:seed:holidays"),
-    /not a valid CapaKraken target/u,
-  );
+  assert.throws(() => assertNexusDbTarget("db:seed:holidays"), /not a valid Nexus target/u);
 });
 
-test("assertCapaKrakenDbTarget explains missing env loading clearly", () => {
+test("assertNexusDbTarget explains missing env loading clearly", () => {
   setEnv({
     DATABASE_URL: undefined,
   });
 
   assert.throws(
-    () => assertCapaKrakenDbTarget("db:update:blueprints"),
-    /Run the command through the CapaKraken env wrappers/u,
+    () => assertNexusDbTarget("db:update:blueprints"),
+    /Run the command through the Nexus env wrappers/u,
   );
 });