Reorganize repo: backend/, deploy/, docs/ layout + AGENTS.md

Restructure the monorepo into clear top-level directories:
- backend/: Go module root (cmd, internal, pkg, configs, migrations,
  docs/swagger, scripts, tests, go.mod, Makefile, .air.toml)
- deploy/: Docker (Dockerfile, docker-compose*), quickstart, fluentd
- docs/: project documentation + reports/ (moved from repo root)
- AGENTS.md: new AI coding-agent guide at repo root

Update all references to the new layout:
- Dockerfile: COPY backend/go.mod, COPY backend/ (context = repo root)
- docker-compose files: context ../.., dockerfile deploy/docker/Dockerfile,
  env_file ../../.env, volume mounts ../../backend:/app
- deploy/quickstart/compose.yaml: dockerfile deploy/docker/Dockerfile
- CI: working-directory: backend for go commands, file deploy/docker/Dockerfile,
  coverage path backend/coverage.out, health_check backend/scripts/
- backend/Makefile: docker target uses -f ../deploy/docker/Dockerfile ../
- README: architecture tree, quickstart, config paths updated

Move root stray scripts (rename_models.*, run_m11_tests.sh, verify_build.sh,
gorm_bool_main.go) to backend/scripts/legacy/. All moves via git mv to
preserve history. Build, vet, SQLite tests, and docker compose config verified.

deploy/docker/Dockerfile

@@ -0,0 +1,69 @@
+# GoChat Dockerfile — Multi-stage build with security hardening
+# Reference: Chatwoot docker/Dockerfile multi-stage pattern + security best practices
+
+# ========== Build Stage ==========
+FROM golang:1.24-alpine AS builder
+
+# Build arguments for version injection
+ARG VERSION=dev
+ARG COMMIT_SHA=unknown
+ARG BUILD_DATE=unknown
+
+WORKDIR /app
+
+# Install git for go mod download with private repos
+RUN apk add --no-cache git
+
+# Dependency layer — cached unless go.mod/go.sum change
+COPY backend/go.mod backend/go.sum ./
+RUN go mod download
+
+# Copy source code (build context = repo root)
+COPY backend/ .
+
+# Build with version info injected via ldflags
+RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 \
+    go build -ldflags="-s -w \
+    -X github.com/gochat/gochat/internal/config.Version=${VERSION} \
+    -X github.com/gochat/gochat/internal/config.CommitSHA=${COMMIT_SHA} \
+    -X github.com/gochat/gochat/internal/config.BuildDate=${BUILD_DATE}" \
+    -o /gochat ./cmd/gochat/
+
+# Build worker binary (same source, --worker-only flag in main)
+RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 \
+    go build -ldflags="-s -w \
+    -X github.com/gochat/gochat/internal/config.Version=${VERSION} \
+    -X github.com/gochat/gochat/internal/config.CommitSHA=${COMMIT_SHA} \
+    -X github.com/gochat/gochat/internal/config.BuildDate=${BUILD_DATE}" \
+    -o /gochat-worker ./cmd/gochat/
+
+# ========== Production Stage ==========
+FROM alpine:3.21
+
+# Install runtime dependencies
+RUN apk --no-cache add ca-certificates tzdata curl &&     addgroup -S gochat && adduser -S gochat -G gochat
+
+WORKDIR /app
+
+# Copy binary and configs from builder
+COPY --from=builder /gochat /app/gochat
+COPY --from=builder /gochat-worker /app/gochat-worker
+COPY configs/ /app/configs/
+COPY migrations/ /app/migrations/
+
+# Set ownership to non-root user
+RUN mkdir -p /app/storage/uploads && chown -R gochat:gochat /app
+
+# Switch to non-root user for security
+USER gochat
+
+# Health check — references the /health endpoint we will add
+HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3     CMD curl -f http://localhost:3000/health || exit 1
+
+EXPOSE 3000
+
+# Default entrypoint — can be overridden for worker mode:
+#   docker run gochat/gochat serve            → API server
+#   docker run gochat/gochat serve --worker-only → background worker
+ENTRYPOINT ["/app/gochat"]
+CMD ["serve"]