backend/
├── product/                 Customer-facing BFF executable
│   ├── main.go
│   ├── go.mod
│   ├── app/                 Startup, composition, HTTP server and health
│   ├── customers/           Customer service, models and Mongo repository
│   ├── auth/                Login/protected HTTP routes, DTOs and configuration
│   ├── sessions/            Session models, refresh storage, cookies and tokens
│   └── verification/        Verification models, configuration and storage
└── shared/                  Reusable library module
    ├── go.mod
    ├── database/            Connection, transactions and repository primitives
    ├── errors/
    ├── logging/
    └── …                    Generic HTTP, configuration and rate-limit helpers

The backoffice BFF belongs in a separate backend/backoffice/ executable module, with its own main.go, go.mod, configuration and operator authentication. It is not implemented by this customer-BFF bootstrap. Shared infrastructure has no main.go and must not depend on an executable module. The product module uses a local replace for ../shared; each module has its own dependency manifest.

Run the product with make run-backend; see its run guide. make test runs both backend modules and the frontend. make lint-backend checks both Go modules and their architecture boundaries.

Copied source remains locally owned. See provenance, the architecture/API plan and the delivery record.