朱子纯 / erp-workflow-plugin

- config-vars.yaml now holds全部 config incl. secrets (database/admin_init.password/secrets), committed
- delete env-local-template; setup-test-db reads config-vars.yaml; gitignore no longer ignores .env.local
- docs-07 single-store rule; db-init/db-design-gen read config-vars.yaml database: section
- drop test_db_allowed_hosts whitelist + schema-looks-like-test guard (trust config-vars.yaml)

Visual clarity: the file tree now matches the README's phase model.
- skills/plan/   — 8 skills (plan-start entry + A0~A6)
- skills/coding/ — 1 skill (coding-start thin entry)

Slugs unchanged. /erp-workflow:<name> still resolves identically because
each SKILL.md declares its own `name:` frontmatter (verified for all 9).

Plugin loader treats the default `./skills/` scan as flat, so the nested
layout is opted into via an explicit path array in plugin.json — the only
mechanism Claude Code provides for nested skill discovery.

Changes:
- mv skills/{plan-start,project-init,scope-lock,skeleton-gen,
       db-design-gen,db-init,downstream-gen,frontend-scope-lock}
     → skills/plan/<same>/
- mv skills/coding-start → skills/coding/coding-start/
- .claude-plugin/plugin.json: skills[] now lists all 9 explicit paths
- README.md: directory tree + Skill 清单 heading updated to reflect grouping

No code touches any skill path (only README did, and only in the tree
diagram). lib tests still pass (62/62).