Align public identity to openXYOS 0.6.3

[XYAIStudio]

Summary

Phase 1 community-edition identity alignment. Runtime, health, and signed-in UI now report openXYOS 0.6.3 from package.json instead of leftover commercial 4.5.x / 0.4.5.3 / 0.50.0-dev numbers.

/api/module-settings already used the open 12-module catalog; this change removes the unused commercial catalog from the active backend path and quarantines unused commercial pages that OpenApp never imported. The 12 signed-in routes are unchanged.

Rebased onto main after community onboarding #4 merged. CONTRIBUTING.md keeps openXYOS branding and the #4 community-guide / Discussions pointer.

This is not a production-readiness claim. Apache-2.0, trademark, and patent boundary documents are unchanged.

Security and data impact

None. No authentication, authorization, tenant isolation, secret, or migration behavior changes. Module settings continue to use backend/routes/open-module-settings.ts and backend/open-module-catalog.ts. Commercial catalog and unused pages were moved under docs/archive/ and are excluded from typecheck and lint.

Verification

npm run ci passed locally after the rebase:

• npm run lint
• npm run typecheck
• npm test (includes test:openxyos-identity)
• npm run verify:open-source
• npm run build (OpenApp chunks only; commercial pages stay archived)

Out of scope / remaining leftovers

• Commercial API mounts such as /api/contracts, /api/assets, /api/attendance remain on the server.
• Historical comments in database adapters may still mention V4.x schema eras.
• Legal pages still describe XYOS as a trademarked product name. LICENSE, NOTICE, and TRADEMARKS.md were left intact.

Checklist

• No credentials, customer data, runtime databases, uploads, logs, or build artifacts are included.
• Tests cover changed behavior and relevant failure paths.
• User-visible changes include both zh-CN and en copy; changed routes were checked in both languages.
• New or changed AI flows have verified output language behavior where applicable.
• Configuration and documentation are updated.
• npm run verify:open-source passes.
• Every commit has a DCO Signed-off-by line.
• A maintainer has verified the applicable ICLA/CCLA and applied cla-signed.

  

[XYAIStudio]

维护者备注：与已合入的 #4（社区引导）冲突。已让云端代理 rebase/merge main、保留两边意图后重跑 npm run ci。

[cursor]

Rebased onto latest main after #4 merged.

Conflict: only CONTRIBUTING.md. Kept both sides: openXYOS branding plus the #4 community-guide / Discussions pointer. CLA and Signed-off-by rules are unchanged.

Preserved from #4: docs/community/, Discussions contact links, README onboarding copy.

Preserved from this PR: 0.6.3 identity from package.json, archived commercial catalog/pages. Commercial pages were not remounted on OpenApp.

Local npm run ci passed after the rebase. Not a production-readiness claim.