fix: security, data-integrity, and doc-drift findings from repo audit

Consolidates duplicate KIS API client implementations (governance tests
were exercising an unused class instead of the one actually running in
production), closes a SQL injection path in the DB admin page, fixes a
migration that used MySQL-only syntax and had never actually applied
(confirmed against production), resyncs docs/db/quantengine.dbml with
all migrations, and removes a duplicate OMS·WMS·ERP frontend tree in
favor of src/frontend/. Also corrects several unverifiable/inflated
claims in the OMS planning docs and realigns CI/CD and architecture
documentation with what's actually in the repo.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

docs/API_REFERENCE.md

@@ -0,0 +1,53 @@
+# QuantEngine API Reference
+
+Full API endpoint tables, extracted from CLAUDE.md (2026-07-30) to keep the main file within
+the character budget.
+
+## Workspace & History (Phase 1)
+All endpoints prefixed with `/api/`:
+
+| Route | Purpose |
+|-------|---------|
+| `GET /state` | Full UI state snapshot |
+| `GET /tables` | Browsable tables list |
+| `GET /table-rows` | Paginated rows |
+| `POST /settings/save` | Save settings |
+| `POST /account-snapshot/save` | Save snapshots |
+| `POST /bootstrap` | Seed DB from JSON |
+| `POST /account-snapshot/import-tsv` | Import TSV |
+| `POST /autofix` | Auto-correct data |
+
+## Collection Pipeline (Phase 2)
+| Route | Purpose |
+|-------|---------|
+| `GET /collection/state` | Dashboard summary (runs, snapshots, errors) |
+| `GET /collection/runs` | Recent collection runs (paginated) |
+| `GET /collection/runs/{runId}/snapshots` | Snapshots from a run |
+| `GET /collection/runs/{runId}/errors` | Errors from a run |
+| `GET /collection/latest/{ticker}` | Latest snapshots for ticker |
+| `POST /collection/run` | Start new collection run (async) |
+
+## Collection Run Status Values
+| Status | Meaning | UI Badge | Transitions |
+|--------|---------|----------|------------|
+| `running` | Collection in progress | <span class="badge bg-warning">진행 중</span> | → completed or failed |
+| `completed` | Collection finished (may have errors) | <span class="badge bg-success">완료</span> | (final) |
+| `failed` | Collection crashed/aborted | <span class="badge bg-danger">실패</span> | (final) |
+| `pending` | Queued, not yet started | <span class="badge bg-secondary">대기 중</span> | → running |
+
+## Collection Run Success Criteria
+**Success** is defined as:
+- Status = `completed` (not `failed`)
+- `TotalSnapshots > 0` (at least one snapshot captured)
+- `TotalErrors == 0` OR `TotalErrors < TotalSnapshots * 0.1` (error rate < 10%)
+
+**Partial Success** (warning state):
+- Status = `completed`
+- `TotalSnapshots > 0` (some data captured)
+- `TotalErrors > 0` (has errors, but not total loss)
+
+**Failure**:
+- Status = `failed` OR
+- Status = `completed` + `TotalSnapshots == 0` (no data captured)
+
+UI: `Pages/Admin/Collection/Index.cshtml` — status 값에 따라 배지 색상 결정, 향후 TotalSnapshots/TotalErrors로 상세 상태 표시