Organize backend into product executable and shared Go modules

backend/product/README.md

@@ -0,0 +1,38 @@
+# SXCHNGE product BFF
+
+This Go module is the customer-facing executable. `main.go` composes the copied
+runtime and local customer service. Customers, auth, sessions and verification
+own their models and supporting code; generic infrastructure comes from the
+sibling `shared` library module.
+
+## Run
+
+Requires Go 1.27 and an SXCHNGE-owned MongoDB replica set for transactions.
+Copy `config.example.yml` to an untracked `config.yml` in this directory. Set:
+
+- `SXCHNGE_MONGO_URI`: URI for SXCHNGE's database.
+- `SXCHNGE_JWT_SECRET`: random signing key, at least 32 bytes for HS256.
+- `SXCHNGE_DOMAIN`: local hostname, such as `localhost:8082`.
+- `SXCHNGE_API_PROTOCOL`: `http` locally, `https` in deployment.
+- `SXCHNGE_API_ENDPOINT`: `/api/v1`.
+
+From the repository root, run `make run-backend`, or run `go run .` here.
+Flags: `-config.file`, `-version`, `-debug`. Configure exact browser origins in
+YAML; browser refresh cookies require HTTPS. An empty local database needs no
+organization, role, policy or seed; the runtime creates its indexes.
+
+The runtime mounts health, login, API login, refresh, rotation and logout routes.
+Customer/application-client records must exist for login. The customer service
+supports atomic account/activation creation and deletion with session revocation.
+Signup/profile HTTP wiring and verification delivery/completion remain follow-up
+work. The frontend still uses dummy services.
+
+Sendico integration is not wired. Its organization context belongs only to the
+future public HTTP adapter. There is no unused public API snapshot in this module;
+copy only the wire definitions consumed by an implemented adapter.
+
+## Validate
+
+`go test -race ./...` and `go vet ./...` validate this module. Tests require Docker
+for disposable Mongo replica sets. Root `make test` and `make lint-backend` also
+validate `shared`. See [source provenance](../PROVENANCE.md).