Task: Convert production frontend to static output backed only by Go APIs

Identity

Convert the Next.js application to static export with no production SSR, Middleware, or Route Handler runtime.
Replace server-rendered authentication/page authorization with a browser auth module that consumes the same-origin Go /api/auth/me contract.
Keep every existing browser business request on same-origin /api, /uploads, and /generated-results routes owned by the Go service.
Serve the exported frontend from an unprivileged Nginx container and update ACK Web Service, probes, Ingress commentary, and deployment assertions.
Preserve Go-side authorization, session-version revocation, and HttpOnly Cookie semantics as the security boundary.

The user explicitly selected a pure static frontend after the production SSR login bridge remained operationally fragile.
The Web workload must have no database credentials, session secret, Go internal URL, or server-side runtime configuration.
Browser requests stay same-origin so no CORS or JavaScript token storage is introduced.
Client-side route guards are presentation only; Go remains authoritative for every protected API.
Existing API response shapes must remain compatible unless a verified Go parity gap requires a focused backend change.
Feature mode may update this task record and implementation/deployment docs; ADR-003 and canonical architecture/current-state promotion require a later Integration task.

Next.js now emits only a static out/ site. The production Root Layout and pages no longer read request Cookies, invoke server authorization, or depend on Middleware/Route Handlers.
Added a browser auth Module around same-origin GET /api/auth/me; it owns response validation, safe post-login navigation, shell identity state, and client-only presentation guards. Go remains the authorization boundary.
Removed middleware.ts, all app/api/** handlers, and the dynamic /uploads and /generated-results Next handlers. Existing browser fetch paths remain unchanged and are routed to Go by Ingress.
Fixed the sole verified browser/Go parity defect: billing adjustment results now serialize lowercase wallet and entry fields.
Replaced the Node production runner with unprivileged Nginx serving out/. The Web Pod has no runtime ConfigMap, session Secret, database credential, or Go internal URL; it exposes only /healthz for workload probes.
Removed deprecated Node Worker and Node migration ACK manifests that could no longer run inside the static Web image. Go embeds the WorkerLoop; first schema creation remains the documented manual SQL operation.
Renamed the first-deployment session Secret owner from zhinian-web-auth to zhinian-go-auth because only Go signs and validates the Cookie.

npm test: PASS, 53 files / 158 tests.
npx tsc --noEmit --incremental false: PASS.
Clean npm run build after deleting generated .next and out: PASS, 14/14 static pages generated and exported; all 12 application routes are static.
go test ./... from backend/: PASS for all packages.
npm run deploy:check: PASS, 7 ACK YAML manifests plus static-runtime assertions.
npm run info: PASS during deployment implementation.
git check-ignore -v deploy/ack/secrets.production.yaml: PASS; the real first-deployment Secret file is protected by an exact repository rule.
git diff --check: PASS after final implementation and documentation.
Mandatory read-only sol_reviewer result: PASS after three review rounds; all reported authentication, first-deployment, documentation, storage-risk, and Secret-ignore blockers were fixed and reverified.
Docker image construction was not executed because the local Docker daemon is unavailable. The Dockerfile pins the official unprivileged Nginx 1.30.4-alpine runner and its build inputs are covered by deployment checks.

Build and smoke the Web image in CI or another host with a Docker daemon.
Deploy new Web and Go images plus the ACK manifests, then verify anonymous login, authenticated /create, logout, administrator pages, static /healthz, Go /api/health, and Go /api/ready on the public origin.
Use a new immutable image tag/digest so IfNotPresent cannot retain the old SSR Web image.
Unreferenced legacy TypeScript server adapters may be removed in a separate cleanup after confirming no operator scripts still consume them; they are not present in the production out/ image.

Amend or supersede ADR-003: the accepted frontend responsibility is static files only, not Next SSR; browser-to-Go same-origin HTTP is the sole runtime application seam. Human confirmation is already present in this task.
Update decision-index.md, current-state.md, system-overview.md, module-map.md, and data-flow.md to record Nginx static Web, Go-only API ownership, browser /api/auth/me, Go-only session Secret ownership, and removal of the Node Worker/migration Job manifests.