refactor: cluster backend under backend/, ops under infra/

[Rakesh1002]

Summary

Eliminates two long-standing root-tree friction points:

1. app/ vs apps/ ambiguity. One letter apart, two completely different things (app/ was the entire Python FastAPI backend; apps/ is the TypeScript packages monorepo). Now: backend/ (the backend) and apps/ (the packages).
2. Backend concerns scattered at root. alembic/, pytest.ini, requirements.txt, tests/, Dockerfile, Dockerfile.cloudflare were each at root — orbital files with no clear ownership. Now all clustered under backend/.
3. Ops scattered at root. nginx/, monitoring/, searxng/ also at root. Now clustered under infra/.

New layout

```
unsearch/
├── backend/ # FastAPI backend — single source of truth
│ ├── app/ # Python module (from app.X import Y unchanged)
│ ├── alembic/ # Postgres migrations
│ ├── tests/ # pytest suite
│ ├── alembic.ini pytest.ini requirements.txt
│ ├── Dockerfile # Self-host image
│ └── Dockerfile.cloudflare # CF Containers image
├── apps/ # TypeScript / SDK packages (pnpm workspace)
├── workers/ # Cloudflare Workers edge
├── infra/ # Operational config
│ ├── nginx/ monitoring/ searxng/
├── docs/ scripts/
└── docker-compose*.yml # Build context = root; mount paths from infra/
```

What did NOT change

• Python module path stays app.X.Y — no `from app.X` → `from backend.X` rewrites. The folder app/ now lives inside backend/; uvicorn is invoked from backend/ so app.main:app still resolves.
• No wire format, no runtime behaviour, no public API surface. This is pure file system reorganization.
• workers/, apps/, scripts/, docs/ unchanged.

What did change (paths only)

• Dockerfiles (backend/Dockerfile, backend/Dockerfile.cloudflare): COPY paths prefixed with backend/; build context stays at repo root.
• docker-compose.yml/.prod.yml/.quickstart.yml: `build: { context: ., dockerfile: backend/Dockerfile }`. nginx + searxng mount paths now ./infra/nginx, ./infra/searxng.
• workers/containers.toml: dockerfile path → ../backend/Dockerfile.cloudflare.
• .github/workflows/ci-cd.yml + deploy-cf.yml: all lint/test/coverage paths prefixed with backend/.
• Makefile: `make dev`, `make test`, `make migrate`, etc. now cd backend before backend operations.
• ecosystem.config.js (PM2): `cwd: './backend'`, `env_file: '../.env'`, `PATH: '../venv/bin:...'`.
• scripts/manage.sh: new `BACKEND_DIR=$PROJECT_DIR/backend`, `cd "$BACKEND_DIR"` before backend ops.
• scripts/{test,run_rag_tests,setup,restore}.sh: cd into backend/ where pytest.ini + alembic.ini live.

Housekeeping

• Delete .turbo/ daemon cache — already in .gitignore, was tracked accidentally. No turbo.json exists in the repo.
• Consolidate scripts/setup_stripe.py + setup_stripe_plans.py — kept the newer setup_stripe_plans.py content (matches the current $19/49/149 pricing tiers) under the canonical filename setup_stripe.py. Existing docs that reference python scripts/setup_stripe.py continue to work.

Docs updated

• ADR-0006 amendment Part 2 — documents this restructure on top of the existing Part 1 (the apps/backend collapse).
• docs/what-is-what.md — full repo map rewritten with new layout, glossary refreshed.
• docs/architecture.md — backend container references updated.
• docs/citation-envelope.md + docs/roadmap.md — implementation paths now backend/app/….
• ADRs 0001, 0002, 0010 — file path mentions updated.
• README.md — repo tree updated, development commands now use cd backend or make.

Risk

• Production deploy: unaffected. CI workflows updated to reflect new paths. `deploy-cf.yml` and `ci-cd.yml` both target backend/ now.
• Local dev: anyone with a checked-out branch will need to re-run `pnpm install` (workspace path moved) and use `make dev` / `make test` instead of bare `uvicorn` / `pytest`.
• Working tree: apps/backend/.env still gitignored — manually remove after diff-comparing with root .env.

Test plan

• `git pull origin main && ls` shows backend/, infra/, no root-level app/ or alembic/ or nginx/.
• `pnpm install` succeeds at root.
• `make dev` starts uvicorn from backend/.
• `make test` runs the pytest suite from backend/.
• `docker compose -f docker-compose.quickstart.yml up -d` brings up the stack.
• CI green on ci-cd.yml quality + tests + deploy-cf.yml worker + container jobs.
• `wrangler containers deploy --config workers/containers.toml` finds ../backend/Dockerfile.cloudflare.