Organize backend into product executable and shared Go modules

docs/implementation.md

@@ -379,7 +379,8 @@ Retained Sendico source is pinned to `8bb20dcd622dd8eb92d289b6b34411e7eccab083`:
 HTTP runtime, local customer/password service and Mongo repository, customer
 sessions and verification storage, generic repository/transaction code, errors,
 logging and health. [Provenance](../backend/PROVENANCE.json) covers 232 retained
-Go files and 112 isolated public OpenAPI files; every adaptation is flagged.
+Go files at that cleanup stage; every adaptation is flagged. The later module
+reorganization below removes the unused public OpenAPI snapshot.
 The Sendico checkout remains unchanged.
 
 Customer creation accepts a raw password, validates/hashes it and commits the
@@ -416,3 +417,32 @@ not been deployed. Existing experimental databases may retain unused tenancy
 collections; this change does not delete external database records. Customer HTTP
 responses now expose only ID, name, last name, login, locale and optional avatar.
 The frontend still uses dummy services and is unchanged.
+
+### Go module organization correction
+
+`backend/` now groups two implemented Go modules: the runnable `product` BFF
+(`main.go`, `go.mod`, configuration and feature packages) and the `shared` library
+(its own `go.mod`, generic storage, errors, logging and HTTP helpers). Product uses
+`replace git.sendico.io/tech/sxchnge/shared => ../shared`. A future backoffice BFF
+belongs in its own `backend/backoffice` executable module; it is not implemented
+or silently combined with product in this task.
+
+Customer, session and verification models/storage now live with their features.
+Shared database code no longer knows about customer repositories. Auth and
+verification configurations belong to their feature packages. The inherited
+`cmd`, `edge`, `internal`, `pkg`, `scripts` and `contracts` top-level folders are
+removed. All 112 unused contract files are removed; future HTTP adapters will
+own only consumed public wire definitions. Provenance retains the pinned upstream
+source paths while recording the new local module paths.
+
+Root Make targets validate both modules independently and run product with
+`cd backend/product && go run .`. Source behavior remains the previously validated
+local customer/auth/session bootstrap; frontend and Sendico source are untouched.
+
+Validation passed after the module moves: `make test` (both Go modules with the
+race detector and all frontend suites), `make lint-backend`, product executable
+build and `-version` smoke check, and `go test -tags integration -run '^$' ./...`
+in each Go module (compile-only for the additional tagged suites). All 233
+provenance source blobs match the pinned revision. `git diff --check` passed.
+No security scans were requested or run. The correction is delivered on `bff-34`
+in [PR #35](https://git.sendico.io/tech/sxchnge/pulls/35), which remains unmerged.