refactor: reorganize project into src layout and update API documentation

Update project structure to use a src/ directory layout and
improve documentation across multiple files.

- Update README.md build command to use ./src
- Add directory structure documentation
- Update status endpoint to include DB health status
- Add pagination support (limit/offset) to whitelist list endpoints
- Document new query parameters with examples
- Update deployment guide to mark API token as required
- Add testing instructions
- Clarify audit log rotation in design documentation

README.md

@@ -18,7 +18,7 @@ On 401/403 NGINX returns the response to the client. Whitelisted IPs never see a
 ## Build
 
 ```bash
-go build -o auth-proxy .
+go build -o auth-proxy ./src
 ```
 
 ## Docker
@@ -42,6 +42,27 @@ vim .env
 ./auth-proxy
 ```
 
+## Directory structure
+
+```
+├── src/
+│   ├── main.go       — entry point
+│   ├── auth.go       — HTTP handlers
+│   ├── db.go         — database operations
+│   ├── config.go     — configuration
+│   ├── cleanup.go    — cleanup goroutine
+│   └── auth_test.go  — unit tests
+├── docs/
+│   ├── api.md
+│   ├── deploy.md
+│   ├── design.md
+│   └── security.md
+├── Dockerfile
+├── docker-compose.yml
+├── go.mod
+└── openapi.yaml
+```
+
 ## API
 
 The API requires a bearer token set via `AUTH_PROXY_API_TOKEN`. All endpoints return `401 Unauthorized` if the token is missing or invalid.
@@ -55,7 +76,7 @@ The API requires a bearer token set via `AUTH_PROXY_API_TOKEN`. All endpoints re
 | GET | `/api/whitelist/perm/list` | List active permanent entries |
 | DELETE | `/api/whitelist/perm/{entry}` | Remove a permanent entry |
 | GET | `/api/logs` | Retrieve audit log entries |
-| GET | `/status` | Health check |
+| GET | `/status` | Health check with DB status |
 
 See `docs/api.md` for full API reference.