Organize backend into product executable and shared Go modules

backend/README.md

@@ -1,41 +1,35 @@
-# SXCHNGE BFF
+# Go backend modules
 
-A locally owned copy of Sendico's reusable BFF runtime, authentication/session
-stack and customer account service. See [provenance](PROVENANCE.md) and the
-[architecture and public API plan](../docs/architecture/bff.md).
+`backend/` groups independent Go modules. It is not an executable or a Go module.
 
-SXCHNGE owns its customers and authentication. SXCHNGE itself is one organization
-in Sendico. Provider integration uses only Sendico's public HTTP API; the pinned
-[OpenAPI snapshot](contracts/sendico/api.yaml) is isolated from local models.
+```text
+backend/
+├── product/                 Customer-facing BFF executable
+│   ├── main.go
+│   ├── go.mod
+│   ├── app/                 Startup, composition, HTTP server and health
+│   ├── customers/           Customer service, models and Mongo repository
+│   ├── auth/                Login/protected HTTP routes, DTOs and configuration
+│   ├── sessions/            Session models, refresh storage, cookies and tokens
+│   └── verification/        Verification models, configuration and storage
+└── shared/                  Reusable library module
+    ├── go.mod
+    ├── database/            Connection, transactions and repository primitives
+    ├── errors/
+    ├── logging/
+    └── …                    Generic HTTP, configuration and rate-limit helpers
+```
 
-## Run locally
+The backoffice BFF belongs in a separate `backend/backoffice/` executable module,
+with its own `main.go`, `go.mod`, configuration and operator authentication. It is
+not implemented by this customer-BFF bootstrap. Shared infrastructure has no
+`main.go` and must not depend on an executable module. The product module uses a
+local `replace` for `../shared`; each module has its own dependency manifest.
 
-Requires Go 1.27 and an SXCHNGE-owned MongoDB replica set for transactions.
-Copy `config.example.yml` to an untracked `config.yml`. Set:
+Run the product with `make run-backend`; see its [run guide](product/README.md).
+`make test` runs both backend modules and the frontend. `make lint-backend` checks
+both Go modules and their architecture boundaries.
 
-- `SXCHNGE_MONGO_URI`: URI for the local SXCHNGE database.
-- `SXCHNGE_JWT_SECRET`: private random signing key, at least 32 bytes for HS256.
-- `SXCHNGE_DOMAIN`: local API hostname (for example `localhost:8082`).
-- `SXCHNGE_API_PROTOCOL`: `http` locally, `https` in deployment.
-- `SXCHNGE_API_ENDPOINT`: `/api/v1`.
-
-The runtime starts against an empty SXCHNGE database and creates its indexes.
-No organization, role, policy or seed is required.
-Run `make run-backend` from the repository root. The copied CLI accepts
-`-config.file`, `-version` and `-debug`. Configure exact browser origins in YAML;
-secure refresh cookies require HTTPS for browser session testing.
-
-The runtime mounts `/api/v1/health` and the copied account login, API login,
-refresh, rotation and logout handlers. Customer/client records must exist in the
-local database. The account service creates customers and activation tokens
-atomically, and deletes customers with session revocation. It is initialized locally; signup/profile and
-verification-delivery/completion routes are the next wiring work. This is a
-bootstrap, not a finished authentication deployment. No Sendico calls are made.
-
-## Validate
-
-Run `make test` and `make lint-backend`. Backend tests include real MongoDB
-integration tests through Testcontainers, so Docker must be running.
-`make test-backend` runs the backend suite with the race detector.
-Architecture checks reject private Sendico imports/transports and ad hoc error
-constructors. The frontend still uses dummy services; no Flutter source changed.
+Copied source remains locally owned. See [provenance](PROVENANCE.md), the
+[architecture/API plan](../docs/architecture/bff.md) and the
+[delivery record](../docs/implementation.md).