Organize backend into product executable and shared Go modules

backend/PROVENANCE.md

@@ -4,9 +4,9 @@ Source repository: `S_I/sendico` (`git.sendico.io`), revision
 `8bb20dcd622dd8eb92d289b6b34411e7eccab083`.
 
 [PROVENANCE.json](PROVENANCE.json) records each retained file, its original path
-and Git blob, and whether a Go file changed beyond namespace replacement and
-formatting. It currently covers 232 Go source/test files and 112 public OpenAPI
-files. Sources came from the pinned commit, not the dirty Sendico checkout.
+and Git blob, and whether a Go file changed beyond import-path replacement and
+formatting. It currently covers 233 Go source/test entries across `product` and `shared`
+(one original configuration file contributes to two feature packages). Sources came from the pinned commit, not the dirty Sendico checkout.
 These are SXCHNGE-owned copies that may diverge independently.
 
 ## Retained implementation
@@ -18,13 +18,11 @@ These are SXCHNGE-owned copies that may diverge independently.
 - Verification issuance, expiry, attempts, consumption and idempotency.
 - Local Mongo connection, transactions and the repository/query implementation
   required by account, session and verification storage, with retained tests.
-- Public OpenAPI 4.2.37 and its recursive schema references, isolated under
-  `contracts/sendico`. These wire files are unchanged except for trailing blank
-  line normalization in three YAML files; they are not local domain models.
-
 ## Adaptations and exclusions
 
-Imports belong to `git.sendico.io/tech/sxchnge/bff`. The composition root selects
+The backend contains Go modules `git.sendico.io/tech/sxchnge/product` and
+`git.sendico.io/tech/sxchnge/shared`. Product owns its executable entry point;
+shared is a dependency library with no executable or domain-module imports. The composition root selects
 local customer services. Discovery, message-bus registration, private gRPC and
 platform factories are absent. Process identity and the refresh cookie use SXCHNGE.
 Startup validates required settings and timeouts, closes failed connections and
@@ -60,3 +58,16 @@ This is a bootstrap. Signup/profile HTTP wiring, verification delivery/completio
 and the public Sendico HTTP adapter remain explicit work in the
 [architecture plan](../docs/architecture/bff.md). The sole Sendico organization
 reference belongs to that adapter's configuration, never to local customers.
+
+## Module organization
+
+`backend/` groups modules; it has no root `go.mod`. The inherited `cmd`, `edge`,
+`internal`, `pkg` and empty `scripts` top-level directories are gone. `product`
+contains `main.go`, its manifest and app/customer/auth/session/verification code.
+`shared` owns its manifest and generic infrastructure. Models moved beside their
+owning features. Customer repository construction moved out of shared database
+code. Auth and verification configurations moved out of application interfaces.
+
+All 112 unconsumed public API snapshot files and their snapshot-only check were
+removed. Future public adapters will own just the wire types they consume.
+Backoffice is a separate future executable module, not an alias for product.