Keep project status tied to pushed evidence

Record the verified frontend and ingress preparation commit in the lifecycle board while preserving Stage 2 as TODO.

Constraint: Stage completion is milestone-based and cannot be inferred from visible files or a running demo.
Confidence: high
Scope-risk: narrow
Directive: Keep S2-C open until Worker recovery and the complete product topology are verified.
Tested: make verify; staged Secret scan; Markdown links and diff checks.
Not-tested: Rotated-key Bailian live smoke remains pending.

docs/04-project-todo.md

@@ -233,6 +233,7 @@ Stage 0 DONE
 
 ### 提交/推送节点
 
+- [x] `S2-PREP`：React 离线演示、Nginx 单入口、四网络隔离、SSE 代理安全修复与质量门禁已随 `c3bad0f` 验证并推送；该前置提交不代表 Stage 2 已启动或完成。
 - [ ] `S2-A`：FastAPI、持久化、健康端点和错误契约。
 - [ ] `S2-B`：任务租约、reaper、fencing 和恢复测试。
 - [ ] `S2-C`：React、Nginx、完整 Compose、CI 和文档；其中 React/Nginx/CI 前置已完成，缺 Worker 与完整 Compose 验收，节点不得提前关闭。