Moved Hugo site, scripts, and npm config under website/

[5anjeev]

Moved Hugo site, scripts, and npm config under website/

Consolidates everything into a single project root. content/mosaic/ becomes website/, scripts/ moves to website/scripts/, and the root package.json / package-lock.json move in alongside hugo.yaml. website/ is now the Hugo root, the npm root, and where the deploy scripts live.

Nothing inside the website contents (orig:content/mosaic/*) changed.

Removed cd content/mosaic from npm scripts, since paths are now local. Both deploy workflows point working-directory and entryPoint at website/, and deploy.yml's Node steps needed cache-dependency-path plus working-directory: website on npm ci and the retention step so CI can find the package files in their new home.

Heads up: package.json no longer sits at the repo root, so npm run ... must be run from website/ (or npm --prefix website run ...). Docs and .cursor rules updated to match.

[northdpole]

Keeping this PR as yours — we are not replacing it.

Why preview failed: GitHub does not give repository secrets to pull_request workflows from forks, so FIREBASE_SERVICE_ACCOUNT was empty. That is expected for any fork PR, not a problem with the website/ move. Hugo itself built fine.

What we changed in this repo (on main, #33): PR jobs now only build the site and upload an artifact. A trusted workflow on OWASP/MOSAIC then publishes the Firebase preview. That means anyone can open a fork PR and still get a preview, without write access.

What still needs to happen on this branch: this PR still has the old workflow that calls Firebase directly. Once pr_deploy.yml on this branch matches main (build + artifact only), preview publish will run and post a URL here.

I can push that one workflow commit onto this branch (maintainers can edit), or you can, whichever you prefer.

Write access: Rob already sent you a write invitation (pending). Accept it at https://github.com/OWASP/MOSAIC/invitations if you want to push branches on OWASP/MOSAIC later. Fork PRs will keep working either way.