Reorganize repo: backend/, deploy/, docs/ layout + AGENTS.md

Restructure the monorepo into clear top-level directories:
- backend/: Go module root (cmd, internal, pkg, configs, migrations,
  docs/swagger, scripts, tests, go.mod, Makefile, .air.toml)
- deploy/: Docker (Dockerfile, docker-compose*), quickstart, fluentd
- docs/: project documentation + reports/ (moved from repo root)
- AGENTS.md: new AI coding-agent guide at repo root

Update all references to the new layout:
- Dockerfile: COPY backend/go.mod, COPY backend/ (context = repo root)
- docker-compose files: context ../.., dockerfile deploy/docker/Dockerfile,
  env_file ../../.env, volume mounts ../../backend:/app
- deploy/quickstart/compose.yaml: dockerfile deploy/docker/Dockerfile
- CI: working-directory: backend for go commands, file deploy/docker/Dockerfile,
  coverage path backend/coverage.out, health_check backend/scripts/
- backend/Makefile: docker target uses -f ../deploy/docker/Dockerfile ../
- README: architecture tree, quickstart, config paths updated

Move root stray scripts (rename_models.*, run_m11_tests.sh, verify_build.sh,
gorm_bool_main.go) to backend/scripts/legacy/. All moves via git mv to
preserve history. Build, vet, SQLite tests, and docker compose config verified.

backend/internal/model/sso_session.go

@@ -0,0 +1,53 @@
+package model
+
+// Reference: M13 §2 — SSO Session model
+// Tracks a user's SSO session across the system for single sign-on and single logout.
+// An SSO session is created when a user authenticates via SAML/OAuth and persists
+// until the user explicitly logs out or the session expires.
+// This enables: (1) SSO — one login grants access to all accounts for that user,
+// (2) SLO — logout terminates all active sessions across all accounts,
+// (3) audit — track when/where a user authenticated and from which IdP.
+
+import (
+	"time"
+
+	"gorm.io/gorm"
+)
+
+// SSOSession represents an active SSO session for a user.
+type SSOSession struct {
+	ID           uint           `gorm:"primaryKey" json:"id"`
+	UserID       uint           `gorm:"not null;index" json:"user_id"`
+	SessionID    string         `gorm:"size:255;not null;uniqueIndex" json:"session_id"` // unique SSO session identifier
+	Provider     string         `gorm:"size:50;not null" json:"provider"`                // saml, google, github
+	IdPEntityID  string         `gorm:"size:512" json:"idp_entity_id,omitempty"`         // SAML IdP entity ID (for SAML sessions)
+	NameID       string         `gorm:"size:512" json:"name_id,omitempty"`               // SAML NameID from the assertion
+	AccountID    uint           `gorm:"not null;index" json:"account_id"`                // account context for this session
+	Role         string         `gorm:"size:50" json:"role"`                             // role in the account
+	AccessToken  string         `gorm:"size:512" json:"-"`                               // issued JWT access token (not exposed via API)
+	RefreshToken string         `gorm:"size:512" json:"-"`                               // issued JWT refresh token (not exposed via API)
+	CreatedAt    time.Time      `gorm:"autoCreateTime" json:"created_at"`
+	ExpiresAt    time.Time      `gorm:"not null;index" json:"expires_at"`                // session expiry time
+	LastSeenAt   time.Time      `gorm:"autoUpdateTime" json:"last_seen_at"`              // last activity timestamp
+	EndedAt      *time.Time     `json:"ended_at,omitempty"`                              // when session was terminated (SLO or explicit logout)
+	Status       string         `gorm:"size:20;not null;default:active" json:"status"`   // active, terminated, expired
+	DeletedAt    gorm.DeletedAt `gorm:"index" json:"deleted_at,omitempty"`
+
+	// Relations
+	User    User    `gorm:"foreignKey:UserID" json:"user,omitempty"`
+	Account Account `gorm:"foreignKey:AccountID" json:"account,omitempty"`
+}
+
+func (SSOSession) TableName() string { return "sso_sessions" }
+
+// IsActive returns whether the SSO session is still valid.
+func (s *SSOSession) IsActive() bool {
+	return s.Status == "active" && s.EndedAt == nil && s.ExpiresAt.After(time.Now())
+}
+
+// Terminate marks the SSO session as terminated (for SLO).
+func (s *SSOSession) Terminate() {
+	now := time.Now()
+	s.Status = "terminated"
+	s.EndedAt = &now
+}