docs: integrate static frontend architecture

.project-docs/00-brief/project-positioning.md

@@ -19,19 +19,27 @@ The project exists to give organizations an Alibaba Cloud ACK-deployable AI crea
 
 - This project does not aim to be a model-training, dataset, or labeling platform.
 - It is not a public social sharing site; assets stay account and organization scoped.
-- In the current version it is not a horizontally auto-scaled multi-region SaaS: one Web replica until generated assets move to shared OSS.
+- In the current version it is not a horizontally auto-scaled multi-region
+  SaaS: the static Web is stateless, but Go remains one replica until generated
+  and uploaded assets move to shared OSS.
 
 ## Core Constraints
 
 - Same-origin browser authentication through signed, chunked `zhinian_session` cookies with per-request account/organization/sessionVersion revalidation.
-- Production persistence fails closed: explicit RDS PostgreSQL through a server-only adapter; local JSON is development/test only.
+- Production persistence fails closed: explicit RDS PostgreSQL through the Go
+  PostgreSQL Adapter; local JSON is development/test only.
+- Production Web is a static export on Nginx. Browser runtime requests stay
+  same-origin and all API/file/auth behavior belongs to Go.
 - Cross-instance concurrency stays in PostgreSQL: `claim_generation_jobs` for job claims and `billing_post_wallet_entry` for wallet idempotency; no process-local lock replacements.
 - Chinese-first product surfaces; production deployment targets Alibaba Cloud ACK.
 
 ## Quality Bar
 
-A good solution should preserve current HTTP/Cookie/authorization behavior, keep provider, billing, and storage semantics idempotent and tenant-scoped, pass the executable contract tests under `contracts/`, and remain reversible through a single-writer cutover.
+A good solution should preserve current HTTP/Cookie/authorization behavior,
+keep provider, billing, and storage semantics idempotent and tenant-scoped,
+pass the executable contracts under `contracts/`, and keep the static Web/Go
+runtime boundary mechanically testable.
 
 ## Last Reviewed
 
-2026-08-14
+2026-08-16

.project-docs/00-brief/success-criteria.md

@@ -2,7 +2,10 @@
 
 ## Project Success
 
-- Production cutover of the Go backend passes the executable contract suites under `contracts/` with real RDS/OSS/provider/Webhook dependencies, without visible user-facing behavior change.
+- The first production deployment serves the static Next.js export reliably,
+  routes every runtime API/file request to Go, and passes executable contracts
+  with real RDS/OSS/provider/Webhook dependencies without user-facing behavior
+  regressions.
 
 ## Task Completion Standard
 
@@ -11,6 +14,8 @@
 ## Quality Checks
 
 - `npm test` (full Vitest suite), `npx tsc --noEmit`, and `npm run build` pass.
+- Static architecture checks reject Next Route Handlers, Middleware,
+  request-time page dependencies, and production `next start`.
 - `go test -count=1 ./...` and `go vet ./...` pass for backend changes.
 - `node scripts/check-ack-manifests.mjs` and `npm run deploy:check` pass for deployment changes.
 - `check_project_docs.py` and `check_doc_drift.py --task-id <task_id>` pass for documentation changes.
@@ -18,4 +23,4 @@
 
 ## Last Reviewed
 
-2026-08-14
+2026-08-16