refactor: reorganize project into src/, docs/, tools/ layout

- src/01-database/  ← 01-Database/
- src/02-server/    ← 02-Server/
- src/03-client/    ← 03-Client/
- docs/             ← CLAUDE.md, DEPLOY.md, SECURITY.md, SETUP.md
- tools/            ← scripts/

Updated all path references in: .gitignore, .gitleaks.toml,
.github/workflows/ci.yml, .github/workflows/cd.yml,
.github/dependabot.yml, README.md, docs/*.md, and TypeScript
source comments. Backend and frontend builds verified clean.

Author: Yuval

.github/dependabot.yml

@@ -9,7 +9,7 @@ version: 2
 updates:
   # Frontend (React + Vite + TypeScript)
   - package-ecosystem: "npm"
-    directory: "/03-Client"
+    directory: "/src/03-client"
     schedule:
       interval: "weekly"
       day: "monday"
@@ -33,7 +33,7 @@ updates:
 
   # Backend (ASP.NET Core 8 + ADO.NET)
   - package-ecosystem: "nuget"
-    directory: "/02-Server"
+    directory: "/src/02-server"
     schedule:
       interval: "weekly"
       day: "monday"

.github/workflows/cd.yml

@@ -42,7 +42,7 @@ jobs:
     runs-on: ubuntu-latest
     defaults:
       run:
-        working-directory: 02-Server
+        working-directory: src/02-server
 
     steps:
       - uses: actions/checkout@v4
@@ -75,7 +75,7 @@ jobs:
         with:
           app-name: app-groundshare-api
           publish-profile: ${{ secrets.AZURE_WEBAPP_PUBLISH_PROFILE }}
-          package: 02-Server/deploy-linux.zip
+          package: src/02-server/deploy-linux.zip
 
       - name: Health check
         run: |
@@ -104,14 +104,14 @@ jobs:
         with:
           node-version: "20"
           cache: "npm"
-          cache-dependency-path: 03-Client/package-lock.json
+          cache-dependency-path: src/03-client/package-lock.json
 
       - name: Install dependencies
-        working-directory: 03-Client
+        working-directory: src/03-client
         run: npm ci
 
       - name: Build
-        working-directory: 03-Client
+        working-directory: src/03-client
         run: npm run build
         env:
           VITE_API_BASE_URL: https://app-groundshare-api.azurewebsites.net/api
@@ -124,7 +124,7 @@ jobs:
       # Doing it this way removes the need to set a Startup Command in the
       # Portal — the zip is self-describing.
       - name: Package dist
-        working-directory: 03-Client
+        working-directory: src/03-client
         run: |
           cp -r dist deploy-frontend
           cat > deploy-frontend/package.json <<'JSON'
@@ -145,7 +145,7 @@ jobs:
         with:
           app-name: app-groundshare-web
           publish-profile: ${{ secrets.AZURE_WEBAPP_FRONTEND_PUBLISH_PROFILE }}
-          package: 03-Client/deploy-frontend.zip
+          package: src/03-client/deploy-frontend.zip
 
       # First-time Oryx build + pm2 warmup on a cold Free-tier App Service
       # can take 2-3 minutes. Poll for up to ~4 minutes before failing.

.github/workflows/ci.yml

@@ -27,7 +27,7 @@ jobs:
     runs-on: ubuntu-latest
     defaults:
       run:
-        working-directory: 02-Server
+        working-directory: src/02-server
 
     steps:
       - uses: actions/checkout@v4
@@ -54,7 +54,7 @@ jobs:
     runs-on: ubuntu-latest
     defaults:
       run:
-        working-directory: 03-Client
+        working-directory: src/03-client
 
     steps:
       - uses: actions/checkout@v4
@@ -63,7 +63,7 @@ jobs:
         with:
           node-version: "20"
           cache: "npm"
-          cache-dependency-path: 03-Client/package-lock.json
+          cache-dependency-path: src/03-client/package-lock.json
 
       - name: Install dependencies
         run: npm ci

.gitignore

@@ -1,36 +1,36 @@
 # Build outputs
-02-Server/bin/
-02-Server/obj/
-02-Server/publish/
-02-Server/publish-linux/
-02-Server/deploy.zip
-02-Server/deploy-linux.zip
+src/02-server/bin/
+src/02-server/obj/
+src/02-server/publish/
+src/02-server/publish-linux/
+src/02-server/deploy.zip
+src/02-server/deploy-linux.zip
 
 # Node modules
-03-Client/node_modules/
+src/03-client/node_modules/
 **/node_modules/
 
 # Build output
-03-Client/dist/
+src/03-client/dist/
 
 # Capacitor native build artifacts (keep source, ignore generated)
-03-Client/android/.gradle/
-03-Client/android/build/
-03-Client/android/app/build/
-03-Client/android/app/src/main/assets/public/
-03-Client/android/app/src/main/assets/capacitor.config.json
-03-Client/android/app/src/main/assets/capacitor.plugins.json
-03-Client/android/local.properties
-03-Client/android/captures/
-03-Client/android/.idea/
-03-Client/ios/App/Pods/
-03-Client/ios/App/build/
-03-Client/ios/App/App/public/
-03-Client/ios/App/App/capacitor.config.json
-03-Client/ios/App/App/config.xml
-03-Client/ios/DerivedData/
-03-Client/ios/App/App.xcworkspace/xcuserdata/
-03-Client/ios/App/App.xcodeproj/xcuserdata/
+src/03-client/android/.gradle/
+src/03-client/android/build/
+src/03-client/android/app/build/
+src/03-client/android/app/src/main/assets/public/
+src/03-client/android/app/src/main/assets/capacitor.config.json
+src/03-client/android/app/src/main/assets/capacitor.plugins.json
+src/03-client/android/local.properties
+src/03-client/android/captures/
+src/03-client/android/.idea/
+src/03-client/ios/App/Pods/
+src/03-client/ios/App/build/
+src/03-client/ios/App/App/public/
+src/03-client/ios/App/App/capacitor.config.json
+src/03-client/ios/App/App/config.xml
+src/03-client/ios/DerivedData/
+src/03-client/ios/App/App.xcworkspace/xcuserdata/
+src/03-client/ios/App/App.xcodeproj/xcuserdata/
 
 # Environment / secrets
 .claude
@@ -55,11 +55,13 @@ Thumbs.db
 *.log
 
 # Uploaded files (local dev storage)
-02-Server/wwwroot/uploads/
+src/02-server/wwwroot/uploads/
 
 # Misc
 reference
 secrets
+# Legacy folder — tracked files moved to src/02-server/; bin/ remains locked on Windows
+02-Server/
 
 # Local-only security docs (contain sensitive incident details / rotation checklists)
 SECURITY_INCIDENT.md

.gitleaks.toml

@@ -8,5 +8,5 @@ title = "GroundShare gitleaks config"
   # documented, non-secret key that ships with the Azure Storage emulator.
   # See: https://learn.microsoft.com/en-us/azure/storage/common/storage-use-azurite
   paths = [
-    '''02-Server/Services/AzureBlobStorageService\.cs'''
+    '''src/02-server/Services/AzureBlobStorageService\.cs'''
   ]

README.md

@@ -28,34 +28,35 @@ gamification system (XP / streaks).
 ## Project layout
 
 ```
-01-Database/   SQL schema + stored procedures (GroundShareDB.sql)
-02-Server/     ASP.NET Core 8 Web API (Controllers / DAL / BL / Services)
-03-Client/     React + Vite frontend + Capacitor native shell
-reference/     Design specs, screen mockups, Hebrew spec docs
-scripts/       Git hooks (gitleaks pre-commit)
-.github/       CI/CD workflows
+.github/              CI/CD workflows
+docs/                 Setup, deploy, security, and AI context docs
+src/
+  01-database/        SQL schema + stored procedures (GroundShareDB.sql)
+  02-server/          ASP.NET Core 8 Web API (Controllers / DAL / BL / Services)
+  03-client/          React + Vite frontend + Capacitor native shell
+tools/                Git hooks (gitleaks pre-commit)
 ```
 
 ## Documentation
 
-- [SETUP.md](SETUP.md) — local development environment setup
-- [DEPLOY.md](DEPLOY.md) — Azure deployment guide
-- [SECURITY.md](SECURITY.md) — security architecture and policy
-- [CLAUDE.md](CLAUDE.md) — AI assistant context (architecture patterns, conventions)
+- [docs/SETUP.md](docs/SETUP.md) — local development environment setup
+- [docs/DEPLOY.md](docs/DEPLOY.md) — Azure deployment guide
+- [docs/SECURITY.md](docs/SECURITY.md) — security architecture and policy
+- [docs/CLAUDE.md](docs/CLAUDE.md) — AI assistant context (architecture patterns, conventions)
 
 ## Quick start
 
 ```bash
-# Database: run 01-Database/GroundShareDB.sql in SSMS against local SQL Express
+# Database: run src/01-database/GroundShareDB.sql in SSMS against local SQL Express
 
 # Backend (port 5227)
-cd 02-Server && dotnet run
+cd src/02-server && dotnet run
 
 # Frontend (port 5173)
-cd 03-Client && npm install && npm run dev
+cd src/03-client && npm install && npm run dev
 ```
 
-Backend requires `02-Server/appsettings.Development.json` (gitignored) with local
+Backend requires `src/02-server/appsettings.Development.json` (gitignored) with local
 SQL connection string, JWT key, and Google Maps API key. See
 [SETUP.md](SETUP.md) for the full config template.
 

CLAUDE.md docs/CLAUDE.mdCLAUDE.md renamed to docs/CLAUDE.md

@@ -15,45 +15,48 @@ Production is live on Azure (Israel Central):
 ## Project structure
 
 ```
-01-Database/        GroundShareDB.sql — complete schema + stored procedures (single source of truth)
+.github/            CI/CD workflows
+docs/               Setup, deploy, security, and AI context docs (this file)
+src/
+  01-database/      GroundShareDB.sql — complete schema + stored procedures (single source of truth)
                     ResetData.sql — wipes user data while keeping schema + lookups
-02-Server/          C# ASP.NET Core 8 Web API
-  Controllers/      18 controllers (Auth, Users, Events, Geo, Locations, Favorites,
+  02-server/        C# ASP.NET Core 8 Web API
+    Controllers/    18 controllers (Auth, Users, Events, Geo, Locations, Favorites,
                     Ai, Comments, Comparisons, Files, Health, Notifications, etc.)
-  DAL/              Data access — pure ADO.NET, NO Entity Framework. All DB calls use
+    DAL/            Data access — pure ADO.NET, NO Entity Framework. All DB calls use
                     SqlConnection + SqlCommand, mostly via stored procedures (sp_*)
-  BL/               Request/response DTOs (LoginRequest, CreateEventRequest, User, etc.)
-  Services/         Business logic (auth, storage, AI, rate limiting)
-  Middleware/       Exception handling, security headers, request logging
-  Validators/       FluentValidation rules for request DTOs
-03-Client/          React 18 + TypeScript + Vite
-  src/app/
-    components/     Screen components (MainScreen, CreateEventScreen, etc.)
-      shared/       Reusable UI (BottomNavBar, TopSearchBar, MapLayout, DrawerMenu, etc.)
-      address-search/  AddressInfoPanel, EventCard, ReviewSection, icons, types
-    context/        AuthContext (JWT + user state), MapContext (map config + overlays)
-    hooks/          useGeolocation, useGoogleMapsKey, useSwipeBack
-    services/       api.ts (all backend calls), addressAutocomplete.ts (data.gov.il)
-    routes.ts       React Router 7 — route definitions with ProtectedRoute/GuestRoute guards
-  src/styles/       tailwind.css, theme.css (CSS variables), fonts.css (Heebo, Poppins)
-  src/assets/       Logo and map mockup images
-  src/imports/      SVG icon path exports
-reference/          Design specs: screen mockups (screens.pdf), workflow diagram, Hebrew spec doc
+    BL/             Request/response DTOs (LoginRequest, CreateEventRequest, User, etc.)
+    Services/       Business logic (auth, storage, AI, rate limiting)
+    Middleware/     Exception handling, security headers, request logging
+    Validators/     FluentValidation rules for request DTOs
+  03-client/        React 18 + TypeScript + Vite
+    src/app/
+      components/   Screen components (MainScreen, CreateEventScreen, etc.)
+        shared/     Reusable UI (BottomNavBar, TopSearchBar, MapLayout, DrawerMenu, etc.)
+        address-search/  AddressInfoPanel, EventCard, ReviewSection, icons, types
+      context/      AuthContext (JWT + user state), MapContext (map config + overlays)
+      hooks/        useGeolocation, useGoogleMapsKey, useSwipeBack
+      services/     api.ts (all backend calls), addressAutocomplete.ts (data.gov.il)
+      routes.ts     React Router 7 — route definitions with ProtectedRoute/GuestRoute guards
+    src/styles/     tailwind.css, theme.css (CSS variables), fonts.css (Heebo, Poppins)
+    src/assets/     Logo and map mockup images
+    src/imports/    SVG icon path exports
+tools/              Pre-commit hook for gitleaks
 ```
 
 ## Running locally
 
 ```bash
-# Database: Run 01-Database/GroundShareDB.sql in SSMS against local SQL Express.
+# Database: Run src/01-database/GroundShareDB.sql in SSMS against local SQL Express.
 # DB starts empty — register your first user through the app's Register screen.
-# To reset between tests: run 01-Database/ResetData.sql
+# To reset between tests: run src/01-database/ResetData.sql
 
 # Backend (port 5227)
-cd 02-Server
+cd src/02-server
 dotnet run
 
 # Frontend (port 5173)
-cd 03-Client
+cd src/03-client
 npm install
 npm run dev
 ```
@@ -167,7 +170,7 @@ POST /api/comparisons                    Save comparison
 
 ## Database rules (MANDATORY)
 
-`01-Database/GroundShareDB.sql` is the **single source of truth** for the entire schema.
+`src/01-database/GroundShareDB.sql` is the **single source of truth** for the entire schema.
 
 - **Never create migration files.** All schema changes (new tables, new SPs, modified SPs, new indexes) go directly into `GroundShareDB.sql`.
 - Every table uses `IF OBJECT_ID(...) IS NULL CREATE TABLE ...` so the file is safe to re-run on existing databases.
@@ -180,7 +183,7 @@ POST /api/comparisons                    Save comparison
 
 ## Adding a full-stack feature (checklist)
 
-1. **Database**: Add table/SP directly in `01-Database/GroundShareDB.sql`, run in SSMS
+1. **Database**: Add table/SP directly in `src/01-database/GroundShareDB.sql`, run in SSMS
 2. **DAL**: Create `XxxDAL.cs` inheriting `DBServices`, call SP with `CreateSP()`
 3. **DTO**: Add request/response models in `BL/`
 4. **Controller**: Create `XxxController.cs` with `[Route("api/xxx")]`, inject DAL

DEPLOY.md docs/DEPLOY.mdDEPLOY.md renamed to docs/DEPLOY.md

@@ -196,7 +196,7 @@ Write-Host "Key Vault:   https://$KEYVAULT_NAME.vault.azure.net"
    - Password: (the one you set above)
    - Database: `GroundShareDB`
 
-2. Open `01-Database/GroundShareDB.sql` and execute it. This creates all tables and stored procedures.
+2. Open `src/01-database/GroundShareDB.sql` and execute it. This creates all tables and stored procedures.
 
 3. **Do NOT run SeedDemoData.sql** — production starts empty. The first user is created via the live `/register` endpoint.
 
@@ -306,7 +306,7 @@ az webapp config appsettings set `
 ### Every deploy:
 
 ```powershell
-cd C:\Users\Yuval\source\repos\Ovalvoi\GroundShare\02-Server
+cd C:\Users\Yuval\source\repos\Ovalvoi\GroundShare\src\02-server
 
 # 1. Clean old artifacts so stale files don't leak into the zip
 Remove-Item -Recurse -Force ./publish, ./publish-linux, ./deploy.zip, ./deploy-linux.zip -ErrorAction SilentlyContinue
@@ -356,7 +356,7 @@ az webapp deployment list-publishing-profiles `
 
 ### Install Capacitor:
 ```powershell
-cd 03-Client
+cd src/03-client
 
 npm install @capacitor/core @capacitor/cli
 npx cap init "GroundShare" "com.groundshare.app" --web-dir dist
@@ -366,7 +366,7 @@ npm install @capacitor/ios @capacitor/android
 
 ### Configure API URL:
 
-Create or update `03-Client/capacitor.config.ts`:
+Create or update `src/03-client/capacitor.config.ts`:
 ```typescript
 import type { CapacitorConfig } from '@capacitor/cli';