Stage 1: backend foundation (Postgres, sessions, accounts, OTel)

- internal/postgres: pgx-over-database/sql pool (otelsql), embedded goose
  migrations into schema 'backend', committed go-jet code + cmd/jetgen tool.
- internal/account: durable accounts + unified telegram/email identities
  (UUIDv7 keys), find-or-create provisioning with unique-conflict handling.
- internal/session: opaque 256-bit tokens stored as a SHA-256 hash, revoke-only
  (no TTL); write-through cache gating /readyz; store + service.
- internal/telemetry: OTel tracer/meter providers (none/stdout) + request-timing
  middleware; internal/config gains Postgres + OTel env loading.
- internal/server: /api/v1 {public,user,internal,admin} skeleton + X-User-ID
  middleware; /readyz checks DB ping + cache; main wires
  telemetry -> db+migrate -> warm cache -> server.
- Tests: unit + integration (build tag 'integration', testcontainers
  postgres:17) for migrations, accounts, sessions, readyz; new integration.yaml.
- Docs: ARCHITECTURE, TESTING, PLAN refinements, root + backend READMEs.

Session/account REST handlers deferred to Stage 6 (gateway); OTLP + dashboards
to Stage 11.

README.md

@@ -32,14 +32,25 @@ supports English Scrabble, Russian Scrabble and Эрудит.
 go build ./backend/...  # per module (the workspace spans several modules)
 go vet ./backend/...
 gofmt -l .              # must print nothing
-go test -count=1 ./backend/...
+go test -count=1 ./backend/...                       # unit tests
+go test -tags=integration -count=1 -p=1 ./backend/... # + Postgres (needs Docker)
 ```
 
+The `integration`-tagged tests start a throwaway `postgres:17-alpine` container
+via testcontainers-go and require a reachable Docker daemon.
+
 ## Run the backend locally
 
+The backend now owns persistence, so it needs Postgres and applies its embedded
+migrations at startup:
+
 ```sh
-go run ./backend/cmd/backend     # serves /healthz and /readyz on :8080
+docker run -d --name scrabble-pg -e POSTGRES_PASSWORD=dev -p 5432:5432 postgres:17-alpine
+BACKEND_POSTGRES_DSN='postgres://postgres:dev@localhost:5432/postgres?search_path=backend&sslmode=disable' \
+  go run ./backend/cmd/backend     # serves /healthz and /readyz on :8080
 ```
 
-Configuration is read from the environment: `BACKEND_HTTP_ADDR` (default
-`:8080`), `BACKEND_LOG_LEVEL` (`debug|info|warn|error`, default `info`).
+Key environment: `BACKEND_HTTP_ADDR` (default `:8080`), `BACKEND_LOG_LEVEL`
+(`debug|info|warn|error`, default `info`), `BACKEND_POSTGRES_DSN` (**required**).
+The full configuration surface and the go-jet regeneration step live in
+[`backend/README.md`](backend/README.md).