Reorganize repo: backend/, deploy/, docs/ layout + AGENTS.md

Restructure the monorepo into clear top-level directories:
- backend/: Go module root (cmd, internal, pkg, configs, migrations,
  docs/swagger, scripts, tests, go.mod, Makefile, .air.toml)
- deploy/: Docker (Dockerfile, docker-compose*), quickstart, fluentd
- docs/: project documentation + reports/ (moved from repo root)
- AGENTS.md: new AI coding-agent guide at repo root

Update all references to the new layout:
- Dockerfile: COPY backend/go.mod, COPY backend/ (context = repo root)
- docker-compose files: context ../.., dockerfile deploy/docker/Dockerfile,
  env_file ../../.env, volume mounts ../../backend:/app
- deploy/quickstart/compose.yaml: dockerfile deploy/docker/Dockerfile
- CI: working-directory: backend for go commands, file deploy/docker/Dockerfile,
  coverage path backend/coverage.out, health_check backend/scripts/
- backend/Makefile: docker target uses -f ../deploy/docker/Dockerfile ../
- README: architecture tree, quickstart, config paths updated

Move root stray scripts (rename_models.*, run_m11_tests.sh, verify_build.sh,
gorm_bool_main.go) to backend/scripts/legacy/. All moves via git mv to
preserve history. Build, vet, SQLite tests, and docker compose config verified.

backend/internal/middleware/csrf_test.go

@@ -0,0 +1,56 @@
+package middleware
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/gin-gonic/gin"
+	"github.com/stretchr/testify/require"
+)
+
+func TestCSRFSkipsChatwootAuthRoutes(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+	router := gin.New()
+	router.Use(CSRF(CSRFConfig{
+		Enabled:        true,
+		Secret:         "test-secret",
+		CookieName:     "_gochat_csrf",
+		HeaderName:     "X-CSRF-Token",
+		TokenLength:    32,
+		SafeMethods:    []string{"GET", "HEAD", "OPTIONS"},
+		SkipPaths:      []string{"/auth/"},
+		CookiePath:     "/",
+		CookieSameSite: "Lax",
+	}))
+	router.POST("/auth/sign_in", func(c *gin.Context) { c.Status(http.StatusOK) })
+
+	recorder := httptest.NewRecorder()
+	request := httptest.NewRequest(http.MethodPost, "/auth/sign_in", nil)
+	router.ServeHTTP(recorder, request)
+
+	require.Equal(t, http.StatusOK, recorder.Code)
+}
+
+func TestCSRFSkipsTokenAuthenticatedAPIRoutes(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+	router := gin.New()
+	router.Use(CSRF(CSRFConfig{
+		Enabled:        true,
+		Secret:         "test-secret",
+		CookieName:     "_gochat_csrf",
+		HeaderName:     "X-CSRF-Token",
+		TokenLength:    32,
+		SafeMethods:    []string{"GET", "HEAD", "OPTIONS"},
+		SkipPaths:      []string{"/api/v1/"},
+		CookiePath:     "/",
+		CookieSameSite: "Lax",
+	}))
+	router.POST("/api/v1/accounts/:account_id/conversations/:conversation_id/messages", func(c *gin.Context) { c.Status(http.StatusOK) })
+
+	recorder := httptest.NewRecorder()
+	request := httptest.NewRequest(http.MethodPost, "/api/v1/accounts/1/conversations/1/messages", nil)
+	router.ServeHTTP(recorder, request)
+
+	require.Equal(t, http.StatusOK, recorder.Code)
+}