Organize backend into product executable and shared Go modules

docs/architecture/bff.md

@@ -15,26 +15,30 @@ and allowed to diverge within this repository.
 Source: `S_I/sendico`, commit `8bb20dcd622dd8eb92d289b6b34411e7eccab083`.
 The source checkout's unrelated dependency edits were not copied.
 
-| Local component | Reused implementation |
-| --- | --- |
-| `backend/edge/shared` | Chi HTTP runtime, middleware, JWT login/pending sessions, refresh/rotation/logout, CSRF/cookies, rate limiting, Mongo verification and refresh-token stores |
-| `backend/edge/product/interface/accountservice` | Account validation, bcrypt passwords, atomic customer creation, activation tokens, password reset and email-change token issuance, deletion |
-| `backend/pkg` | Canonical local account/domain models, Mongo repositories/transactions, errors, structured logging, process bootstrap and health |
-| `backend/internal/profile` | Small SXCHNGE composition layer selecting the copied local account service |
-| `backend/contracts/sendico` | Separate snapshot of Sendico's public OpenAPI contract and its referenced schemas |
+`backend/` groups Go modules. The implemented executable is `backend/product`,
+with its own `main.go` and `go.mod`. `backend/shared` is a separate library module.
+Backoffice will be a separate executable module (`backend/backoffice`) with its
+own entry point, operator identity, configuration and deployment. Product's entry
+point is not the entry point for every future backend.
 
-Source provenance and the bounded adaptations are in
-[PROVENANCE.md](../../backend/PROVENANCE.md). There is no sibling source import,
-private Sendico module requirement, gRPC client, discovery subscription or broker
-connection. Platform engines and Product's platform-provisioning bootstrap were
-not copied. The original handwritten shell and tiny replacement helpers were removed.
+| Owner | Retained implementation |
+| --- | --- |
+| `product/app` | HTTP runtime, startup, composition and health |
+| `product/customers` | Local customer models, service and account repository |
+| `product/auth` | Login/protected routes, local DTOs/mappers and auth configuration |
+| `product/sessions` | Session/client models, refresh storage, cookies and token generation |
+| `product/verification` | Verification models, configuration and storage |
+| `shared` | Generic database/transaction/query code, errors, logging and HTTP helpers |
+
+Shared infrastructure imports no executable module. Customer repositories are
+constructed by the product module rather than the generic database factory.
+There is no global customer/session model package or Sendico `edge/product`
+source hierarchy. Source provenance follows the moved files across Go modules.
 
 Local customers have no organization membership, roles, policies or tenant ID.
-The account service validates and hashes passwords, creates an account and
-activation token atomically, and deletes an account with session revocation.
-Customer responses map to explicit local DTOs. Account, token and session collections and application client records belong only
-to SXCHNGE. The runtime starts without any policy or tenant seed. Casbin,
-invitations, financial models and provisioning machinery are excluded.
+Creation validates/hashes passwords and commits the account and activation token
+atomically. Deletion revokes that customer's sessions. The runtime starts without
+any seed. Casbin, invitations and platform provisioning are absent.
 
 ## Identity and ownership
 
@@ -57,9 +61,11 @@ Confirm the deployed credential policy before configuring a provider client.
 
 ## Contract and service structure
 
-The copied OpenAPI files are a pinned upstream wire contract, not SXCHNGE's app
-API or domain model. Preserve them as an isolated snapshot. Changes require an
-explicit contract update; do not follow Sendico source updates automatically.
+The bootstrap has no Sendico runtime calls and therefore no copied public wire
+snapshot. When implementing an adapter, keep only its consumed request/response
+contracts within that adapter. Pin their upstream revision separately from local
+customer DTOs/models; do not copy the entire platform contract or synchronize
+source automatically.
 
 When wiring a feature, keep the existing architecture:
 
@@ -73,13 +79,13 @@ or replace local account services with Sendico login/customer calls.
 
 The next adapter will use a configured public HTTPS base URL, a fixed organization
 reference, bounded request timeouts and an injected HTTP transport. It must reject
-cross-origin credential redirects. Reuse the existing public contract and response
-conventions; do not invent a parallel provider facade or call internal services.
+cross-origin credential redirects. Use the public contract and response
+conventions for each implemented operation; do not invent a parallel provider facade or call internal services.
 
 ## Required public Sendico capabilities
 
-The snapshot is API version 4.2.37. Source routes and schemas establish available
-shapes; they do not prove that a deployment enables every feature.
+The source reviewed at the pinned revision describes API version 4.2.37. Its
+public routes and schemas establish available shapes; they do not prove that a deployment enables every feature.
 
 | Need | Existing public surface / work required |
 | --- | --- |
@@ -120,7 +126,8 @@ operation details explain what has happened and what remains pending.
 
 ## Current delivery boundary
 
-This task supplies the copied starting point and isolated public contracts.
+This task supplies the selected copied starting point in independently buildable
+Go modules and a public API integration plan.
 The local runtime installs the existing authentication transport and account
 service. Local signup/profile HTTP endpoints, verification delivery/completion,
 application client setup, Flutter HTTP adapters and live Sendico calls