refactor: move Python implementation to legacy/, make Go primary

Go (go/) becomes the primary implementation. The original Python
version moves to legacy/ and is kept runnable; new features are still
built in both (see the Dual implementation rule in CLAUDE.md).

- git mv app.py, scripts/, templates/, tests/, pyproject.toml, uv.lock
  and build/ into legacy/
- Makefile: Python targets point at legacy/, venv in legacy/.venv,
  CREDENTIALS_PATH exported for the root .secret/ file
- CI and make image build the Python image with legacy/ as context;
  the Makefile is no longer copied into the image
- legacy/.dockerignore moved to the context root so it takes effect
- CLAUDE.md, docs/README.md, Go comments, fixture README, capture
  script and VS Code launch config updated to the new layout

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

go/internal/web/api/build_common.go

@@ -12,7 +12,7 @@ import (
 
 // getMonthLabels builds display labels for sortedMonths, merging month names
 // (e.g. "Dec+Jan 2026") when mergedMonths maps a source month into this target.
-// Mirrors scripts/views.py:get_month_labels.
+// Mirrors legacy/scripts/views.py:get_month_labels.
 func getMonthLabels(sortedMonths []string, mergedMonths map[string]string) map[string]string {
 	labels := make(map[string]string, len(sortedMonths))
 	for _, m := range sortedMonths {
@@ -72,14 +72,14 @@ func labelsForMonths(sortedMonths []string, labels map[string]string) []string {
 var questionMarkRe = regexp.MustCompile(`\[\?\]\s*`)
 
 // canonicalKey returns a normalized form of a person name used for deduplication.
-// Mirrors scripts/match_payments.py:canonical_member_key.
+// Mirrors legacy/scripts/match_payments.py:canonical_member_key.
 func canonicalKey(name string) string {
 	return strings.Join(strings.Fields(czech.Normalize(name)), " ")
 }
 
 // groupRawPaymentsByPerson groups transactions by the "person" column,
 // canonicalizing names against memberNames where possible.
-// Mirrors scripts/views.py:group_payments_by_person (without the
+// Mirrors legacy/scripts/views.py:group_payments_by_person (without the
 // "Unmatched / Unknown" bucket that is payments-view-specific).
 func groupRawPaymentsByPerson(txns []domreconcile.Transaction, memberNames []string) map[string][]RawTransaction {
 	canonicalByKey := make(map[string]string, len(memberNames))