Reorganize backend to mirror Musify.slnx folder structure

Moves the six backend projects on disk into Core/ and Hosts/
subfolders, matching the solution folders already defined in
Musify.slnx, so the file explorer reflects the same layout as the
solution:

  backend/Core/Musify.Domain
  backend/Core/Musify.Application
  backend/Core/Musify.Infrastructure
  backend/Hosts/Musify.Api
  backend/Hosts/Musify.Worker
  backend/Hosts/Musify.StreamingGateway

Updates every reference to the old paths: ProjectReference entries in
Musify.Api.csproj and Musify.Worker.csproj, the three Dockerfiles,
deploy/scripts/migrate.ps1|sh, deploy/zitadel/provision.ps1,
deploy/up.ps1, deploy/README.md and docs/development.md. Also fixes a
stale Dockerfile comment pointing at a compose file that no longer
exists.

Verified with `dotnet build Musify.slnx` against the new layout.

backend/Hosts/Musify.Api/OpenApi/OpenApiExtensions.cs

@@ -0,0 +1,14 @@
+using Microsoft.AspNetCore.OpenApi;
+
+namespace Musify.Api.OpenApi;
+
+public static class OpenApiExtensions
+{
+    public static IServiceCollection AddOpenApiConfiguration(this IServiceCollection services)
+    {
+        services.AddOpenApi();
+        services.ConfigureOptions<OpenApiOptionsSetup>();
+
+        return services;
+    }
+}

backend/Hosts/Musify.Api/OpenApi/OpenApiOptionsSetup.cs

@@ -0,0 +1,66 @@
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.OpenApi;
+using Microsoft.Extensions.Options;
+using Microsoft.OpenApi;
+using Musify.Api.Authentication;
+
+namespace Musify.Api.OpenApi;
+
+public sealed class OpenApiOptionsSetup(IOptions<AuthenticationConfiguration> options)
+    : IConfigureNamedOptions<OpenApiOptions>
+{
+    private const string SecuritySchemeId = "OAuth2";
+
+    private readonly AuthenticationConfiguration _configuration = options.Value;
+
+    public void Configure(string? name, OpenApiOptions options) => Configure(options);
+
+    public void Configure(OpenApiOptions options)
+    {
+        options.AddDocumentTransformer((document, _, _) =>
+        {
+            document.Components ??= new OpenApiComponents();
+            document.Components.SecuritySchemes ??= new Dictionary<string, IOpenApiSecurityScheme>();
+            document.Components.SecuritySchemes[SecuritySchemeId] = new OpenApiSecurityScheme
+            {
+                Type = SecuritySchemeType.OAuth2,
+                Flows = new OpenApiOAuthFlows
+                {
+                    AuthorizationCode = new OpenApiOAuthFlow
+                    {
+                        AuthorizationUrl = new Uri(_configuration.AuthorizationEndpoint),
+                        TokenUrl = new Uri(_configuration.TokenEndpoint),
+                        Scopes = _configuration.Scopes.ToDictionary(scope => scope, scope => scope),
+                    },
+                },
+            };
+
+            return Task.CompletedTask;
+        } );
+
+        options.AddOperationTransformer((operation, context, _) =>
+        {
+            var requiresAuthorization = context.Description.ActionDescriptor.EndpointMetadata
+                .OfType<IAuthorizeData>()
+                .Any();
+
+            var allowsAnonymous = context.Description.ActionDescriptor.EndpointMetadata
+                .OfType<IAllowAnonymous>()
+                .Any();
+
+            if (!requiresAuthorization || allowsAnonymous)
+            {
+                return Task.CompletedTask;
+            }
+
+            operation.Security ??= new List<OpenApiSecurityRequirement>();
+            operation.Security.Add(new OpenApiSecurityRequirement
+            {
+                [new OpenApiSecuritySchemeReference(SecuritySchemeId, context.Document)] =
+                    _configuration.Scopes.ToList(),
+            } );
+
+            return Task.CompletedTask;
+        } );
+    }
+}