docs(agents): update knowledge base with encryption, API envelope, and build conventions (#127)

Add comprehensive documentation of project conventions including:
- Encryption patterns (AES with node secret PSK)
- API envelope structure (code, msg, data, ts)
- Build peculiarities (minify: false, rolldown-vite, UPX compression)
- Unique styles (flat monorepo, asymmetric Go layout, hybrid frontend mode)
- Module boundaries and anti-patterns
- Large file hotspots and code map references

Updated 7 AGENTS.md files across root and submodules.

go-backend/AGENTS.md

@@ -1,8 +1,8 @@
 # GO BACKEND KNOWLEDGE BASE
 
 ## OVERVIEW
-Go-based Admin API for FLVX (formerly Flux Panel). Replaces the legacy Spring Boot backend.
-**Stack:** Go 1.23, net/http (std lib), SQLite (modernc.org/sqlite).
+Go-based Admin API for FLVX. Replaced legacy Spring Boot backend.
+**Stack:** Go 1.23, net/http (std lib), SQLite/PostgreSQL (modernc.org/sqlite - CGO-free).
 
 ## STRUCTURE
 ```
@@ -34,14 +34,21 @@ go-backend/
 
 ## CONVENTIONS
 - **No ORM**: Uses raw SQL with `database/sql` and `modernc.org/sqlite`.
+- **CGO-Free SQLite**: `modernc.org/sqlite` instead of `mattn/go-sqlite3` - builds without CGO.
 - **Standard Lib**: Uses `net/http` for routing (Go 1.22+ patterns).
 - **Auth**: Expects raw JWT in `Authorization` header (no `Bearer` prefix).
+- **API Envelope**: All responses use `response.R{code, msg, data, ts}` structure.
 - **Config**: Loaded from environment variables (see `cmd/paneld/main.go`).
+- **SQL Idempotency**: Prefer `ON CONFLICT DO NOTHING` for inserts in migrations/sync.
+
+## ANTI-PATTERNS
+- **DO NOT USE** ORM - uses raw SQL throughout.
+- **DO NOT CHANGE** handler signatures without updating `router.go`.
 
 ## COMMANDS
 ```bash
 cd go-backend
-go run ./cmd/paneld
+go run ./cmd/paneld       # Default: SERVER_ADDR=:6365
 go test ./...
 make build
 ```

go-backend/internal/http/handler/AGENTS.md

@@ -1,6 +1,6 @@
 # BACKEND HTTP HANDLER KNOWLEDGE BASE
 
-**Generated:** Fri Feb 13 2026
+**Generated:** Sun Feb 15 2026
 
 ## OVERVIEW
 HTTP request handlers for FLVX Admin API. Core business logic layer.
@@ -29,8 +29,9 @@ handler/
 
 ## CONVENTIONS
 - Inherits from parent: raw SQL, no ORM, JWT in Authorization header.
-- Large files expected (`mutations.go` >100k LOC).
+- Large files expected (`mutations.go` 3716 LOC - central mutation hub).
 - Uses `sqlite.Repository` for DB access via `repo.XXX()` methods.
+- Domain-driven file split: one file per functional area (federation, jobs, etc.).
 
 ## ANTI-PATTERNS
 - Do NOT add ORM here - uses raw SQL throughout.