Reorganize repo: backend/, deploy/, docs/ layout + AGENTS.md

Restructure the monorepo into clear top-level directories:
- backend/: Go module root (cmd, internal, pkg, configs, migrations,
  docs/swagger, scripts, tests, go.mod, Makefile, .air.toml)
- deploy/: Docker (Dockerfile, docker-compose*), quickstart, fluentd
- docs/: project documentation + reports/ (moved from repo root)
- AGENTS.md: new AI coding-agent guide at repo root

Update all references to the new layout:
- Dockerfile: COPY backend/go.mod, COPY backend/ (context = repo root)
- docker-compose files: context ../.., dockerfile deploy/docker/Dockerfile,
  env_file ../../.env, volume mounts ../../backend:/app
- deploy/quickstart/compose.yaml: dockerfile deploy/docker/Dockerfile
- CI: working-directory: backend for go commands, file deploy/docker/Dockerfile,
  coverage path backend/coverage.out, health_check backend/scripts/
- backend/Makefile: docker target uses -f ../deploy/docker/Dockerfile ../
- README: architecture tree, quickstart, config paths updated

Move root stray scripts (rename_models.*, run_m11_tests.sh, verify_build.sh,
gorm_bool_main.go) to backend/scripts/legacy/. All moves via git mv to
preserve history. Build, vet, SQLite tests, and docker compose config verified.

backend/internal/handler/api/v1/email_oauth_authorization.go

@@ -0,0 +1,62 @@
+package v1
+
+import (
+	"fmt"
+	"net/url"
+	"os"
+	"strings"
+	"time"
+
+	"github.com/golang-jwt/jwt/v5"
+)
+
+type chatwootEmailOAuthAuthorizationConfig struct {
+	ClientIDEnv     string
+	ClientSecretEnv string
+	AuthorizeURL    string
+	RedirectPath    string
+	Scope           string
+	ExtraParams     map[string]string
+}
+
+func buildChatwootEmailOAuthAuthorizationURL(accountID uint, cfg chatwootEmailOAuthAuthorizationConfig) (string, error) {
+	clientID := strings.TrimSpace(os.Getenv(cfg.ClientIDEnv))
+	clientSecret := strings.TrimSpace(os.Getenv(cfg.ClientSecretEnv))
+	if clientID == "" || clientSecret == "" {
+		return "", fmt.Errorf("email OAuth is not configured")
+	}
+
+	state, err := signedChatwootOAuthState(accountID, clientSecret)
+	if err != nil {
+		return "", err
+	}
+
+	frontendURL := strings.TrimRight(envOrDefaultV1("FRONTEND_URL", "http://localhost:3000"), "/")
+	params := url.Values{}
+	params.Set("client_id", clientID)
+	params.Set("redirect_uri", frontendURL+cfg.RedirectPath)
+	params.Set("response_type", "code")
+	params.Set("scope", cfg.Scope)
+	params.Set("state", state)
+	for key, value := range cfg.ExtraParams {
+		params.Set(key, value)
+	}
+
+	return cfg.AuthorizeURL + "?" + params.Encode(), nil
+}
+
+func signedChatwootOAuthState(accountID uint, secret string) (string, error) {
+	return signedChatwootOAuthStateWithReturnTo(accountID, secret, "")
+}
+
+func signedChatwootOAuthStateWithReturnTo(accountID uint, secret string, returnTo string) (string, error) {
+	claims := jwt.MapClaims{
+		"sub": accountID,
+		"iat": time.Now().Unix(),
+	}
+	if strings.TrimSpace(returnTo) != "" {
+		claims["return_to"] = strings.TrimSpace(returnTo)
+	}
+	token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
+	return token.SignedString([]byte(secret))
+}