refactor: serve static frontend with Go APIs

backend/README.md

@@ -1,10 +1,10 @@
 # Go modular backend
 
-This directory contains the separately runnable Go implementation of ADR-003.
-It now owns the checked-in compatibility implementation for all 66 explicit
-HTTP method/path entries, but it is **not** the current production traffic
-owner: Next.js, the Node Worker, Docker Compose, and the ACK manifests remain
-unchanged until a later, explicit cutover.
+This directory contains the production application backend. Go is the sole
+runtime owner of `/api`, `/uploads`, and `/generated-results`, including browser
+sessions, authorization, persistence, provider calls, and the embedded
+WorkerLoop. The frontend is a static Next.js export served by Nginx and calls
+these Go routes through the public same-origin Ingress.
 
 Implemented Modules:
 
@@ -76,8 +76,8 @@ docker build -f backend/Dockerfile.runtime \
 ```
 
 The runner defaults to `CGO_ENABLED=0` for reproducible cross-platform builds.
-To exercise the local foundation manually without changing the existing Next
-server, use a different port:
+To exercise the backend locally, listen on port 8080 and route browser API
+requests there with a same-origin development proxy:
 
 ```bash
 ZHINIAN_DATA_BACKEND=local GO_BACKEND_PORT=8080 ./backend/zhinian-api
@@ -85,8 +85,7 @@ ZHINIAN_DATA_BACKEND=local GO_BACKEND_PORT=8080 ./backend/zhinian-api
 
 In local mode, persistent business data is process-local and is discarded on
 restart; it is intended only for development and contract smoke tests. The
-default demo identity is the same optional-auth super administrator used by the
-current Next development flow.
+default demo identity supports the optional-auth frontend development flow.
 
 ## First super administrator
 
@@ -105,7 +104,8 @@ process startup so a misconfigured bootstrap is visible instead of silently
 missing. Local development mode keeps the seeded demo administrator and never
 bootstrap-creates accounts.
 
-No Ingress, Docker, ACK, Secret, or Worker ownership has moved to Go yet, so
-Next.js remains the deployed owner of every route. Real RDS/CA, OSS, provider,
-Webhook, Worker drain/recovery, and rollback validation are mandatory before
-that route ownership changes.
+Production routing, Secret ownership, probes, and rollout commands are defined
+in [`../docs/DEPLOYMENT.md`](../docs/DEPLOYMENT.md) and `../deploy/ack/`. Go owns
+the session signing Secret and backend runtime configuration; the static Web
+workload receives neither. Validate RDS/CA, OSS, providers, Webhooks, embedded
+Worker recovery, and rollback behavior for each production release.