Rewrite FastAPI app and pipeline worker entrypoint.

Worker still refuses to import backend.main. Auth router is mounted
unchanged; CORS stays outermost so 401s keep headers.

tests/test_periscope_app_rewrite.py

@@ -0,0 +1,45 @@
+"""Native FastAPI app and worker entrypoint resolve from src."""
+
+from __future__ import annotations
+
+import ast
+from pathlib import Path
+
+import backend.main as main_mod
+import backend.pipeline_worker as worker_mod
+from backend.main import LOCAL_DEV_USER, app
+
+
+def _src(mod, name: str) -> Path:
+    path = Path(mod.__file__).resolve()
+    assert path.name == name
+    assert "src" in path.parts
+    assert "Native Periscope overlay" not in path.read_text(encoding="utf-8")[:400]
+    return path
+
+
+def test_main_and_worker_are_src():
+    _src(main_mod, "main.py")
+    _src(worker_mod, "pipeline_worker.py")
+
+
+def test_worker_does_not_import_fastapi_app():
+    tree = ast.parse(Path(worker_mod.__file__).read_text(encoding="utf-8"))
+    for node in ast.walk(tree):
+        if isinstance(node, ast.Import):
+            for alias in node.names:
+                assert alias.name != "backend.main"
+        if isinstance(node, ast.ImportFrom) and node.module:
+            assert not node.module.startswith("backend.main")
+            if node.module == "backend":
+                for alias in node.names:
+                    assert alias.name != "main"
+
+
+def test_app_mounts_auth_and_public_user():
+    paths = set(app.openapi()["paths"])
+    assert any(p.startswith("/api/auth") for p in paths)
+    assert any(p.startswith("/api/projects") for p in paths)
+    assert LOCAL_DEV_USER == "local"
+    assert "/api/auth/login" in main_mod._PUBLIC_PATHS
+    assert "/api/contact" in main_mod._PUBLIC_PATHS