Reorganize repo: backend/, deploy/, docs/ layout + AGENTS.md

Restructure the monorepo into clear top-level directories:
- backend/: Go module root (cmd, internal, pkg, configs, migrations,
  docs/swagger, scripts, tests, go.mod, Makefile, .air.toml)
- deploy/: Docker (Dockerfile, docker-compose*), quickstart, fluentd
- docs/: project documentation + reports/ (moved from repo root)
- AGENTS.md: new AI coding-agent guide at repo root

Update all references to the new layout:
- Dockerfile: COPY backend/go.mod, COPY backend/ (context = repo root)
- docker-compose files: context ../.., dockerfile deploy/docker/Dockerfile,
  env_file ../../.env, volume mounts ../../backend:/app
- deploy/quickstart/compose.yaml: dockerfile deploy/docker/Dockerfile
- CI: working-directory: backend for go commands, file deploy/docker/Dockerfile,
  coverage path backend/coverage.out, health_check backend/scripts/
- backend/Makefile: docker target uses -f ../deploy/docker/Dockerfile ../
- README: architecture tree, quickstart, config paths updated

Move root stray scripts (rename_models.*, run_m11_tests.sh, verify_build.sh,
gorm_bool_main.go) to backend/scripts/legacy/. All moves via git mv to
preserve history. Build, vet, SQLite tests, and docker compose config verified.

backend/internal/model/permissible.go

@@ -0,0 +1,32 @@
+package model
+
+import (
+	"time"
+)
+
+// Permissible represents a permission rule linking a PlatformApp to an authorized resource.
+// Reference: Chatwoot PlatformAppPermissible + P2B M12 spec (polymorphic Permissible pattern)
+//
+// Each Permissible record means "PlatformApp X can operate on Resource Y".
+// Resource types (PermissibleType) include: Account, User, AgentBot.
+// When a PlatformApp creates a user/account/agent_bot, a Permissible record is auto-created
+// to grant the PlatformApp access to that resource.
+type Permissible struct {
+	ID              uint      `gorm:"primaryKey;autoIncrement" json:"id"`
+	PlatformAppID   uint      `gorm:"not null;uniqueIndex:idx_permissibles_unique" json:"platform_app_id"`
+	PermissibleType string    `gorm:"size:100;not null;uniqueIndex:idx_permissibles_unique;index" json:"permissible_type"` // Account, User, AgentBot
+	PermissibleID   uint      `gorm:"not null;uniqueIndex:idx_permissibles_unique;index" json:"permissible_id"`
+	CreatedAt       time.Time `gorm:"autoCreateTime" json:"created_at"`
+	UpdatedAt       time.Time `gorm:"autoUpdateTime" json:"updated_at"`
+
+	PlatformApp PlatformApp `gorm:"foreignKey:PlatformAppID" json:"platform_app,omitempty"`
+}
+
+func (Permissible) TableName() string { return "permissibles" }
+
+// PermissibleTypes — valid polymorphic types for the Permissible model.
+const (
+	PermissibleTypeAccount  = "Account"
+	PermissibleTypeUser     = "User"
+	PermissibleTypeAgentBot = "AgentBot"
+)