Move the package into src/

Thirty-seven entries in the root, most of them .go files. The assets had to
come along: //go:embed cannot reach outside its own directory, so
templates/, static/ and migrations/ live beside the code that embeds them,
and testdata/ beside the test that reads it. storage/ stays put — runtime
data, not source.

go build now needs -o. Without it the output would be named after the
package directory and collide with src/ itself.

README.md

@@ -82,9 +82,13 @@ in as that account and mint invites for everyone else. The two variables are rea
 
 ```sh
 export ADMIN_EMAIL=[email protected] ADMIN_PASSWORD=dev SECURE_COOKIES=false
-go run .
+go run ./src
 ```
 
+The package lives in `src/`, together with the `templates/`, `static/` and `migrations/` it embeds —
+`//go:embed` cannot reach outside its own directory, so the assets live beside the code that reads
+them. `storage/` stays at the root, since it is runtime data rather than source.
+
 Requires Go 1.27+, plus `ffmpeg`, `ffprobe`, and `yt-dlp` on `PATH`. There is nothing to start first:
 the database is a file under `./storage`, created on the first run.