docs: consolidate repository guides and preserve audit history

docs/architecture/backend.md

@@ -1,75 +1,7 @@
-# Backend Architecture
+# Backend architecture
 
-## Purpose
+`JobTrackerApi/` is the ASP.NET Core 9 host. Controllers expose `/api` endpoints, services contain domain orchestration, `JobTrackerContext` owns EF Core persistence and tenant filters, and hosted services handle scheduled or recoverable work.
 
-Define backend organisation.
+The API supports local email/password accounts, Google and Microsoft identity sign-in where configured, cookie sessions with CSRF protection, Identity roles, TOTP two-factor authentication, session revocation, email verification/reset, rate limits, and admin-only system/audit surfaces.
 
----
-
-# Preferred Structure
-
-Example:
-
-Application
-
-├── Features
-
-├── Domain
-
-├── Infrastructure
-
-├── Services
-
-├── API
-
----
-
-# Responsibilities
-
-## API Layer
-
-Handles:
-
-- HTTP requests.
-- Authentication.
-- Validation.
-- Responses.
-
-Should not contain business logic.
-
----
-
-## Application Layer
-
-Handles:
-
-- Workflows.
-- Business operations.
-- Coordination.
-
----
-
-## Domain Layer
-
-Contains:
-
-- Entities.
-- Rules.
-- Business concepts.
-
----
-
-## Infrastructure
-
-Handles:
-
-- Database.
-- External APIs.
-- File storage.
-- AI providers.
-
----
-
-# Rule
-
-Controllers should remain thin.
+The largest orchestration boundaries are `JobApplicationsController`, `ProfileCvController`, and `StartupInitializationExtensions`. They are recorded as conditional refactoring debt; file size alone is not a reason for a rewrite. See [API reference](../backend/api.md), [background jobs](../backend/background-jobs.md), and [technical debt](../roadmap/technical-debt.md).