docs: update file paths to reflect src/ reorganization

- Update README.md to note that core code is organized in src/ directory
- Update ARCHITECTURE.md with complete src/ file paths including middleware and validators
- Update DEVELOPMENT.md with src/ paths for Node.js debugging and profiling commands
- Ensure all documentation consistently references new directory structure

Author: NotoriousArnav

AGENTS.md

@@ -1,18 +1,21 @@
 # AGENTS.md — Quick Guide for Coding Agents
+
 Scope: entire repo. Always branch first (feature/... or fix/...), never commit to master/main.
 Build/run: `npm ci`; dev: `npm run dev`; prod: `npm start`.
 Health check: `npm run ping` or `curl http://localhost:3000/ping`.
-Tests: none configured; use curl/manual checks. If Jest is added: `npx jest path/to.test.js -t "name"` for single tests.
-Lint/format: ESLint v9+ is configured (see eslint.config.js). Use 2‑space indent, single quotes, semicolons, trailing newline. Run `npx eslint . --ext .js` before committing.
+Tests: Jest configured; use `npx jest path/to.test.js -t "name"` for single tests.
+Lint/format: ESLint v9+ is configured (see eslint.config.js). Use 2-space indent, single quotes, semicolons, trailing newline. Run `npx eslint . --ext .js` before committing.
 Modules: CommonJS only (`require`/`module.exports`). Do not introduce ESM.
-Imports: group built‑in, deps, local; use relative paths (`./`, `../`). Avoid deep coupling.
+Imports: group built-in, deps, local; use relative paths (`./`, `../`). Avoid deep coupling.
 Types: plain JS; add JSDoc for complex functions. Do not add TS files unless requested.
 Naming: camelCase vars/functions; PascalCase classes; UPPER_SNAKE for constants/env.
 Errors: validate inputs; respond JSON `{ ok:false, error }` with correct HTTP codes; avoid uncaught throws in handlers.
-Logging: use `logger.js` helpers (`httpLogger`, `wireSocketLogging`, `appLogger`). Never log secrets.
-MongoDB: reuse a single client (no per‑request connects). Keep auth state in `mongoAuthState.js`.
-Routes: define in `routes.js` as `[{ method, path, handler }]`; use `req.app.locals.whatsapp_socket`.
-Socket lifecycle: in `index.js`; don’t change without need; keep HTTP and socket separate.
+Logging: use `src/logger.js` helpers (`httpLogger`, `wireSocketLogging`, `appLogger`). Never log secrets.
+MongoDB: reuse a single client (no per-request connects). Keep auth state in `src/mongoAuthState.js`.
+Routes: define in `src/routes.js` as `[{ method, path, handler }]`; use `req.app.locals.whatsapp_socket`.
+Socket lifecycle: in `src/index.js`; don't change without need; keep HTTP and socket separate.
+Middleware: auth in `src/middleware/authMiddleware.js`; webhooks in `src/middleware/webhookSecurityMiddleware.js`.
+Validators: schemas in `src/validators/validationSchemas.js`; apply with `validateRequest` middleware.
 Env vars: `HOST`, `PORT`, `MONGO_URL`, `DB_NAME`; keep README and `.env.example` in sync.
 API shape: return `{ ok: boolean, ... }`; keep endpoints small and testable.
 Docs: update `docs/API_Reference.md` and `README.md` when adding/modifying endpoints.

README.md

@@ -155,6 +155,7 @@ curl -X POST http://localhost:3000/accounts/mybot/message/send \
 - **Config:** See `eslint.config.js` in the project root.
 - **CI:** Linting is enforced in GitHub Actions.
 - **Style:** 2-space indent, single quotes, trailing commas, semicolons, CommonJS modules.
+- **Core Code:** Application code is organized in the `src/` directory with structured subdirectories for middleware, validators, and types.
 
 <table>
   <tr>

docs/ARCHITECTURE.md

@@ -37,14 +37,19 @@ This document describes the high-level architecture of the Wildcat WhatsApp inte
 
 ### Key Files
 
-- **`index.js`** - Application entry point, initializes managers and starts server
-- **`server.js`** - Express app construction and server startup
-- **`managementRoutes.js`** - Global routes (accounts, webhooks, media)
-- **`accountRouter.js`** - Per-account routes (messages, status)
-- **`socketManager.js`** - WhatsApp socket lifecycle management
-- **`accountManager.js`** - Account CRUD operations
-- **`mediaHandler.js`** - Media download/upload to GridFS
-- **`logger.js`** - Structured logging utilities
+- **`src/index.js`** - Application entry point, initializes managers and starts server
+- **`src/server.js`** - Express app construction and server startup
+- **`src/managementRoutes.js`** - Global routes (accounts, webhooks, media)
+- **`src/accountRouter.js`** - Per-account routes (messages, status)
+- **`src/socketManager.js`** - WhatsApp socket lifecycle management
+- **`src/accountManager.js`** - Account CRUD operations
+- **`src/mediaHandler.js`** - Media download/upload to GridFS
+- **`src/logger.js`** - Structured logging utilities
+- **`src/middleware/authMiddleware.js`** - HTTP authentication middleware
+- **`src/middleware/webhookSecurityMiddleware.js`** - Webhook request validation
+- **`src/validators/validationSchemas.js`** - Input validation schemas
+- **`src/db.js`** - MongoDB connection management
+- **`src/mongoAuthState.js`** - WhatsApp auth state persistence
 
 ## Data Flow
 

docs/DEVELOPMENT.md

@@ -64,7 +64,7 @@ docs: update API reference
 - **Formatting:** Consistent indentation (2 spaces)
 - **Naming:** camelCase for variables/functions, PascalCase for classes
 - **Error Handling:** Use try/catch, return structured error responses
-- **Logging:** Use the provided logger utilities
+- **Logging:** Use the provided logger utilities from `src/logger.js`
 
 ### API Design
 
@@ -195,11 +195,11 @@ NODE_ENV=development
 
 ```bash
 # Memory usage
-node --inspect index.js
+node --inspect src/index.js
 
 # Performance monitoring
 npm install -g clinic
-clinic doctor -- node index.js
+clinic doctor -- node src/index.js
 ```
 
 ## Security