refactor: move Python implementation to legacy/, make Go primary

Go (go/) becomes the primary implementation. The original Python
version moves to legacy/ and is kept runnable; new features are still
built in both (see the Dual implementation rule in CLAUDE.md).

- git mv app.py, scripts/, templates/, tests/, pyproject.toml, uv.lock
  and build/ into legacy/
- Makefile: Python targets point at legacy/, venv in legacy/.venv,
  CREDENTIALS_PATH exported for the root .secret/ file
- CI and make image build the Python image with legacy/ as context;
  the Makefile is no longer copied into the image
- legacy/.dockerignore moved to the context root so it takes effect
- CLAUDE.md, docs/README.md, Go comments, fixture README, capture
  script and VS Code launch config updated to the new layout

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

legacy/scripts/capture_all_fixtures.sh

@@ -0,0 +1,47 @@
+#!/usr/bin/env bash
+# Regenerate the full fixture corpus.
+# Safe to re-run — always overwrites.
+# Requires: legacy/tmp/*_cache.json present (for real-data seeds for parse_month_references and match_members).
+
+set -euo pipefail
+
+LEGACY="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+REPO="$(cd "$LEGACY/.." && pwd)"
+FIXTURES="$REPO/go/tests/fixtures"
+CAPTURE_CMD="PYTHONPATH=$LEGACY/scripts:$LEGACY python3 $LEGACY/scripts/capture_fixtures.py"
+SCRUB_CMD="python3 $LEGACY/scripts/scrub_fixtures.py"
+
+run_func() {
+    local func="$1"
+    local dir="$FIXTURES/pure/$func"
+    mkdir -p "$dir"
+    echo "  Capturing $func..."
+    eval "$CAPTURE_CMD --func $func --all" | while IFS= read -r line; do
+        case_id="$(python3 -c "import sys,json; print(json.loads('''$line''')['case'])" 2>/dev/null || \
+                   echo "$line" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d['case'])")"
+        echo "$line" | python3 "$LEGACY/scripts/scrub_fixtures.py" > "$dir/${case_id}.json"
+    done
+}
+
+echo "==> Capturing pure-function fixtures..."
+
+run_func normalize
+run_func parse_month_references
+run_func calculate_fee
+run_func calculate_junior_fee
+run_func parse_czk_amount
+run_func generate_sync_id
+run_func build_name_variants
+run_func match_members
+run_func infer_transaction_details
+run_func format_date
+
+echo "==> Capturing reconcile fixtures..."
+mkdir -p "$FIXTURES/reconcile"
+eval "$CAPTURE_CMD --func reconcile --all" | while IFS= read -r line; do
+    case_id="$(echo "$line" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d['case'])")"
+    echo "$line" | python3 "$LEGACY/scripts/scrub_fixtures.py" > "$FIXTURES/reconcile/${case_id}.json"
+done
+
+echo "==> Done. Review with: git diff go/tests/fixtures/"
+echo "==> Audit PII: git ls-files go/tests/fixtures | xargs grep -l '<real name>' should return zero."