Move to the layout REPO_POLICIES.md gives (closes #30)

The Go module moves from backend/ to the root (go.mod, go.sum,
.golangci.yml, cmd/, internal/), the page's source to web/, and nginx's
two files to configs/. backend/ is gone: its LICENSE and .dockerignore
are deleted, and its .gitignore entries, README and scripts are folded
into the root ones. script/build builds the server binary after the
frontend; script/run and script/clean move up from backend/script/;
make test, lint, fmt and fmt-check do what the backend's did. Vite's
root is web/ and it still builds into dist/. go.mod ignores
node_modules/, whose npm packages can ship .go files. script/bootstrap
no longer installs gcc, which only the host Go tests needed.

Model: opus-5-5

Dockerfile

@@ -21,15 +21,15 @@ RUN yarn install --frozen-lockfile
 COPY . .
 RUN yarn eslint .
 
-# Lint phase: golangci-lint over the backend with backend/.golangci.yml,
+# Lint phase: golangci-lint over the Go packages with .golangci.yml,
 # and eslint through the copy from frontend-lint at the end. The
 # golangci/golangci-lint image ships Go and the linter.
 # golangci/golangci-lint:v2.14.0, 2026-09-24
 FROM golangci/golangci-lint@sha256:ad862ba6b3798cbe0fd9fd7408d498fd74fbd2623a92406b2fd3898faf0bf98f AS lint
 WORKDIR /src
-COPY backend/go.mod backend/go.sum ./
+COPY go.mod go.sum ./
 RUN go mod download
-COPY backend/ .
+COPY . .
 RUN golangci-lint run --config .golangci.yml ./...
 # Nothing is wanted from frontend-lint; the copy is what makes this
 # phase run it.
@@ -69,7 +69,7 @@ RUN yarn build
 # golang:1.25.7-trixie, 2026-10-07
 FROM golang@sha256:2b174ffcf56c7ad0c47d30d2630693265639ddf2a5141149c2da34db921791b4 AS test
 WORKDIR /src
-COPY backend/ .
+COPY . .
 RUN --mount=type=tmpfs,target=/go/pkg/mod \
     --mount=type=tmpfs,target=/root/.cache/go-build \
     go test -timeout 90s -race -cover ./... || \
@@ -90,13 +90,12 @@ RUN apk add --no-cache git
 # A tar-stream context keeps the sender's file owners, which git refuses.
 RUN git config --system --add safe.directory /src
 WORKDIR /src
-COPY backend/go.mod backend/go.sum backend/
-RUN cd backend && go mod download
+COPY go.mod go.sum ./
+RUN go mod download
 COPY . .
 
-# backend/script/build is the one definition of the build command:
-# CGO_ENABLED=0 go build -trimpath -ldflags "-s -w -X main.Version=..."
-# It reads VERSION from the environment.
+# The same go build as in script/build, which builds the binary on the
+# host.
 #
 # The version is the VERSION build argument when one is given, otherwise
 # `git describe --tags --always` on the .git in the build context: the
@@ -112,7 +111,9 @@ RUN version="${VERSION:-$(git describe --tags --always)}"; \
             exit 1 ;; \
         esac; \
     fi; \
-    VERSION="$version" backend/script/build
+    CGO_ENABLED=0 go build -trimpath \
+        -ldflags "-s -w -X main.Version=$version" \
+        -o netwatch-server ./cmd/netwatch-server/
 
 # Runtime stage, and the last one: a plain `docker build .` builds it
 # and the stages it copies from, the two phases included.
@@ -128,10 +129,10 @@ RUN addgroup -g 1000 -S netwatch && \
 # At start-up the nginx image renders every template here into
 # conf.d; bin/entrypoint.sh says how.
 RUN rm /etc/nginx/conf.d/default.conf
-COPY nginx.conf /etc/nginx/templates/netwatch.conf.template
-COPY security-headers.conf /etc/nginx/security-headers.conf
+COPY configs/nginx.conf /etc/nginx/templates/netwatch.conf.template
+COPY configs/security-headers.conf /etc/nginx/security-headers.conf
 COPY --from=frontend /app/dist /usr/share/nginx/html
-COPY --from=builder /src/backend/netwatch-server /usr/local/bin/netwatch-server
+COPY --from=builder /src/netwatch-server /usr/local/bin/netwatch-server
 COPY bin/entrypoint.sh /usr/local/bin/entrypoint.sh
 
 # bin/entrypoint.sh creates DATA_DIR at start and gives it and /data to