refactor: move Python implementation to legacy/, make Go primary

Go (go/) becomes the primary implementation. The original Python
version moves to legacy/ and is kept runnable; new features are still
built in both (see the Dual implementation rule in CLAUDE.md).

- git mv app.py, scripts/, templates/, tests/, pyproject.toml, uv.lock
  and build/ into legacy/
- Makefile: Python targets point at legacy/, venv in legacy/.venv,
  CREDENTIALS_PATH exported for the root .secret/ file
- CI and make image build the Python image with legacy/ as context;
  the Makefile is no longer copied into the image
- legacy/.dockerignore moved to the context root so it takes effect
- CLAUDE.md, docs/README.md, Go comments, fixture README, capture
  script and VS Code launch config updated to the new layout

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

legacy/build/Dockerfile

@@ -0,0 +1,43 @@
+FROM python:3.13-alpine
+
+RUN apk add --no-cache bash tzdata \
+    && cp /usr/share/zoneinfo/Europe/Prague /etc/localtime \
+    && echo "Europe/Prague" > /etc/timezone
+
+ENV PYTHONUNBUFFERED=1
+
+WORKDIR /app
+
+RUN pip install --no-cache-dir \
+    flask \
+    google-api-python-client \
+    google-auth-httplib2 \
+    google-auth-oauthlib \
+    qrcode \
+    pillow \
+    gunicorn
+
+COPY app.py ./
+COPY scripts/ ./scripts/
+COPY templates/ ./templates/
+
+COPY build/entrypoint.sh /entrypoint.sh
+RUN chmod +x /entrypoint.sh
+
+ARG GIT_TAG=unknown
+ARG GIT_COMMIT=unknown
+ARG BUILD_DATE=unknown
+
+LABEL org.opencontainers.image.version="${GIT_TAG}" \
+      org.opencontainers.image.revision="${GIT_COMMIT}" \
+      org.opencontainers.image.created="${BUILD_DATE}" \
+      org.opencontainers.image.title="fuj-management"
+
+RUN echo "{\"tag\": \"${GIT_TAG}\", \"commit\": \"${GIT_COMMIT}\", \"build_date\": \"${BUILD_DATE}\"}" > /app/build_meta.json
+
+EXPOSE 5001
+
+HEALTHCHECK --interval=60s --timeout=5s --start-period=5s \
+    CMD wget -q -O /dev/null http://localhost:5001/ || exit 1
+
+ENTRYPOINT ["/entrypoint.sh"]