chore: Remove obsolete microservices directories and update all references

- Delete data-entry-app/ (1.6GB), reports-app/ (447MB), .auto-build-data/
- Saved ~1.4GB disk space (64% reduction: 2.2GB → 845MB)

Updated references across 38 files:
- .claude/rules/ paths: backend/modules/, src/modules/
- .claude/commands/validate.md: all validation paths
- docs/ (13 files): data-entry, telegram, README, CLAUDE.md
- scripts/ (3 files): backup-secrets, restore-secrets, test-docker
- security/ (2 files): git_cleanup, SECURITY_PROCEDURES
- deployment/ & shared/: updated all stale comments

All paths now reflect ultrathin monolith architecture:
- Backend: backend/modules/{reports,data_entry,telegram}/
- Frontend: src/modules/{reports,data-entry}/
- Shared: shared/{auth,database,routes}/

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

public/web.config

@@ -1,28 +1,52 @@
 <?xml version="1.0" encoding="UTF-8"?>
+<!--
+  ====================================================================
+  ROA2WEB - Internal Application Server Configuration
+  ====================================================================
+
+  ⚠️ IMPORTANT - READ BEFORE DEPLOYMENT! ⚠️
+
+  This web.config is for the INTERNAL application server (10.0.20.36)
+
+  **Production Architecture (2-Tier IIS)**:
+
+  Public Server (10.0.20.122) → uses different web.config!
+    └─ Proxies to Internal Server (10.0.20.36) → uses THIS web.config
+          └─ Proxies to Backend (localhost:8000)
+
+  See: deployment/windows/docs/TWO-TIER-IIS-DEPLOYMENT.md
+
+  **Deployment**:
+  - This file is built into dist/ by Vite
+  - Copy to: C:\inetpub\wwwroot\roa2web\web.config (on 10.0.20.36)
+  - For public server config, see: deployment/windows/config/web.config.10.0.20.122-PUBLIC
+
+  ====================================================================
+-->
 <configuration>
   <system.webServer>
     <rewrite>
       <rules>
-        <!-- Proxy all API requests to unified backend -->
+        <!-- Proxy API requests to unified backend on localhost -->
         <rule name="Proxy Unified API" stopProcessing="true">
-          <match url="^api/(.*)" />
+          <match url="^roa2web/api/(.*)" />
           <action type="Rewrite" url="http://localhost:8000/api/{R:1}" />
         </rule>
 
-        <!-- Proxy uploads to unified backend -->
+        <!-- Proxy uploads to unified backend on localhost -->
         <rule name="Proxy Uploads" stopProcessing="true">
-          <match url="^uploads/(.*)" />
+          <match url="^roa2web/uploads/(.*)" />
           <action type="Rewrite" url="http://localhost:8000/uploads/{R:1}" />
         </rule>
 
         <!-- SPA fallback - all other routes serve index.html -->
         <rule name="SPA Fallback" stopProcessing="true">
-          <match url=".*" />
+          <match url="^roa2web/.*" />
           <conditions logicalGrouping="MatchAll">
             <add input="{REQUEST_FILENAME}" matchType="IsFile" negate="true" />
             <add input="{REQUEST_FILENAME}" matchType="IsDirectory" negate="true" />
           </conditions>
-          <action type="Rewrite" url="/index.html" />
+          <action type="Rewrite" url="/roa2web/index.html" />
         </rule>
       </rules>
     </rewrite>