Reorganize repo: backend/, deploy/, docs/ layout + AGENTS.md

Restructure the monorepo into clear top-level directories:
- backend/: Go module root (cmd, internal, pkg, configs, migrations,
  docs/swagger, scripts, tests, go.mod, Makefile, .air.toml)
- deploy/: Docker (Dockerfile, docker-compose*), quickstart, fluentd
- docs/: project documentation + reports/ (moved from repo root)
- AGENTS.md: new AI coding-agent guide at repo root

Update all references to the new layout:
- Dockerfile: COPY backend/go.mod, COPY backend/ (context = repo root)
- docker-compose files: context ../.., dockerfile deploy/docker/Dockerfile,
  env_file ../../.env, volume mounts ../../backend:/app
- deploy/quickstart/compose.yaml: dockerfile deploy/docker/Dockerfile
- CI: working-directory: backend for go commands, file deploy/docker/Dockerfile,
  coverage path backend/coverage.out, health_check backend/scripts/
- backend/Makefile: docker target uses -f ../deploy/docker/Dockerfile ../
- README: architecture tree, quickstart, config paths updated

Move root stray scripts (rename_models.*, run_m11_tests.sh, verify_build.sh,
gorm_bool_main.go) to backend/scripts/legacy/. All moves via git mv to
preserve history. Build, vet, SQLite tests, and docker compose config verified.

backend/internal/auth/benchmark_test.go_BAK

@@ -0,0 +1,156 @@
+package auth
+
+import (
+	"testing"
+
+	"github.com/gochat/gochat/internal/config"
+	"github.com/gochat/gochat/internal/model"
+)
+
+// ============================================================================
+// JWT Service Benchmarks
+// ============================================================================
+
+// BenchmarkJWTService_GenerateTokenPair benchmarks JWT token pair generation.
+// Reference: Chatwoot DeviseTokenAuth generates tokens in ~5-15ms (Ruby).
+func BenchmarkJWTService_GenerateTokenPair(b *testing.B) {
+	cfg := &config.JWTConfig{
+		Secret:             "benchmark-secret-key-for-jwt-testing",
+		ExpiryHours:        1,
+		RefreshExpiryHours: 168,
+	}
+	svc := NewJWTService(cfg)
+	user := &model.User{
+		Base:     model.Base{ID: 42},
+		Name:     "Benchmark Agent",
+		Email:    "bench_jwt@test.com",
+		Provider: "email",
+		Role:     "agent",
+	}
+
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		_, err := svc.GenerateTokenPair(user, 1, "agent")
+		if err != nil {
+			b.Fatal(err)
+		}
+	}
+}
+
+// BenchmarkJWTService_ValidateAccessToken benchmarks JWT access token validation.
+// Reference: Chatwoot DeviseTokenAuth validates tokens in ~3-10ms (Ruby).
+func BenchmarkJWTService_ValidateAccessToken(b *testing.B) {
+	cfg := &config.JWTConfig{
+		Secret:             "benchmark-secret-key-for-jwt-testing",
+		ExpiryHours:        1,
+		RefreshExpiryHours: 168,
+	}
+	svc := NewJWTService(cfg)
+	user := &model.User{
+		Base:     model.Base{ID: 42},
+		Name:     "Benchmark Agent",
+		Email:    "bench_jwt@test.com",
+		Provider: "email",
+		Role:     "agent",
+	}
+
+	pair, err := svc.GenerateTokenPair(user, 1, "agent")
+	if err != nil {
+		b.Fatal(err)
+	}
+
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		_, err := svc.ValidateAccessToken(pair.AccessToken)
+		if err != nil {
+			b.Fatal(err)
+		}
+	}
+}
+
+// BenchmarkJWTService_ValidateRefreshToken benchmarks JWT refresh token validation.
+func BenchmarkJWTService_ValidateRefreshToken(b *testing.B) {
+	cfg := &config.JWTConfig{
+		Secret:             "benchmark-secret-key-for-jwt-testing",
+		ExpiryHours:        1,
+		RefreshExpiryHours: 168,
+	}
+	svc := NewJWTService(cfg)
+	user := &model.User{
+		Base:     model.Base{ID: 42},
+		Name:     "Benchmark Agent",
+		Email:    "bench_jwt@test.com",
+		Provider: "email",
+		Role:     "agent",
+	}
+
+	pair, err := svc.GenerateTokenPair(user, 1, "agent")
+	if err != nil {
+		b.Fatal(err)
+	}
+
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		_, err := svc.ValidateRefreshToken(pair.RefreshToken)
+		if err != nil {
+			b.Fatal(err)
+		}
+	}
+}
+
+// ============================================================================
+// Policy Evaluation Benchmarks
+// ============================================================================
+
+// BenchmarkPolicy_Can_Agent benchmarks the Can() permission check for agent role.
+// Reference: Chatwoot Pundit policy check — Ruby takes ~2-5ms per check.
+func BenchmarkPolicy_Can_Agent(b *testing.B) {
+	policyCtx := NewPolicyContext(42, 1, "agent", 0, nil)
+
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		policyCtx.Can("read", "conversation")
+	}
+}
+
+// BenchmarkPolicy_Can_Administrator benchmarks the Can() permission check for admin role.
+func BenchmarkPolicy_Can_Administrator(b *testing.B) {
+	policyCtx := NewPolicyContext(1, 1, "administrator", 0, nil)
+
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		policyCtx.Can("read", "conversation")
+	}
+}
+
+// BenchmarkPolicy_Can_CustomRole benchmarks the Can() permission check for custom role.
+func BenchmarkPolicy_Can_CustomRole(b *testing.B) {
+	customPerms := PermissionMatrixMap{
+		DimensionConversationManage:    PermissionRead,
+		DimensionConversationDelete:    PermissionNone,
+		DimensionContactManage:         PermissionFull,
+		DimensionReportManage:          PermissionNone,
+		DimensionKnowledgeBaseManage:   PermissionRead,
+		DimensionAutomationManage:      PermissionNone,
+	}
+	policyCtx := NewPolicyContext(5, 1, "custom_role", 10, customPerms)
+
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		policyCtx.Can("manage", "contact")
+	}
+}
+
+// BenchmarkPolicy_MultiCan benchmarks checking multiple permissions sequentially.
+// Simulates a real request that checks several permissions before allowing action.
+func BenchmarkPolicy_MultiCan(b *testing.B) {
+	policyCtx := NewPolicyContext(42, 1, "agent", 0, nil)
+
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		policyCtx.Can("read", "conversation")
+		policyCtx.Can("create", "message")
+		policyCtx.Can("read", "inbox")
+		policyCtx.Can("read", "contact")
+	}
+}