Move the package into src/

Thirty-seven entries in the root, most of them .go files. The assets had to
come along: //go:embed cannot reach outside its own directory, so
templates/, static/ and migrations/ live beside the code that embeds them,
and testdata/ beside the test that reads it. storage/ stays put — runtime
data, not source.

go build now needs -o. Without it the output would be named after the
package directory and collide with src/ itself.

Dockerfile

@@ -5,7 +5,7 @@ WORKDIR /src
 COPY go.mod go.sum ./
 RUN go mod download
 COPY . .
-RUN CGO_ENABLED=0 go build -ldflags "-X main.version=${VERSION}" -o /levyraati .
+RUN CGO_ENABLED=0 go build -ldflags "-X main.version=${VERSION}" -o /levyraati ./src
 
 FROM alpine:3.24
 # yt-dlp rots against YouTube. Alpine's active branch tracks it closely (3.24 carries the current

Makefile

@@ -16,8 +16,10 @@ vet:
 test:
 	go test ./...
 
+# -o is required, not stylistic: the package lives in ./src, and without it `go build` would try to
+# write a binary named "src" over the directory.
 build:
-	go build -o levyraati26-go .
+	go build -o levyraati26-go ./src
 
 # Templates and migrations are embedded, so seeing a change means rebuilding.
 run: build

README.md

@@ -82,9 +82,13 @@ in as that account and mint invites for everyone else. The two variables are rea
 
 ```sh
 export ADMIN_EMAIL=[email protected] ADMIN_PASSWORD=dev SECURE_COOKIES=false
-go run .
+go run ./src
 ```
 
+The package lives in `src/`, together with the `templates/`, `static/` and `migrations/` it embeds —
+`//go:embed` cannot reach outside its own directory, so the assets live beside the code that reads
+them. `storage/` stays at the root, since it is runtime data rather than source.
+
 Requires Go 1.27+, plus `ffmpeg`, `ffprobe`, and `yt-dlp` on `PATH`. There is nothing to start first:
 the database is a file under `./storage`, created on the first run.