Restructure compliance tools

.gitignore

@@ -589,4 +589,7 @@ tmp
 compliance_keypair.txt
 backend/files
 *.db-wal
-*.db-shm
+*.db-shm
+
+!scripts/offline_python_linux_amd64/venv_linux_amd64/venv/
+!scripts/offline_python_linux_amd64/venv_linux_amd64/venv/lib

backend/services/main/routes/envelope_messaging.py

@@ -501,7 +501,7 @@ async def extract_message_for_compliance(
         "data": compliance_data,
         "instructions": [
             "Transfer this data to an air-gapped machine",
-            "Use compliance_decryption.py decrypt --input-file <json_file>",
+            "Use scripts/compliance/decryption/main.py decrypt --input-file <json_file>",
             "Keep the compliance private key offline at all times"
         ]
     }

docs/COMPLIANCE_DECRYPTION.md

@@ -29,7 +29,7 @@ The application uses client-server encryption for direct messages (DMs). While r
 ### 3. Files Required
 
 - `compliance_keypair.txt` - Contains compliance X25519 keypair
-- `compliance_decryption.py` - Decryption script
+- `scripts/compliance/decryption/main.py` — decryption tool entrypoint
 - Message data extracted from the server
 
 ## Step-by-Step Instructions
@@ -70,11 +70,11 @@ The application uses client-server encryption for direct messages (DMs). While r
 
 1. Ensure you have the required files:
   - `compliance_keypair.txt` (compliance private key)
-  - `compliance_decryption.py` (decryption script)
+  - `scripts/compliance/decryption/main.py` (decryption tool)
   - `compliance_MESSAGE_ID.json` (extracted message data)
 2. Run the decryption:
   ```bash
-   python compliance_decryption.py decrypt --input-file compliance_MESSAGE_ID.json
+   python scripts/compliance/decryption/main.py decrypt --input-file compliance_MESSAGE_ID.json
   ```
 3. The script will output the decrypted message:
   ```
@@ -177,7 +177,7 @@ Response: JSON with encrypted message data
 ### Decryption Script
 
 ```bash
-python compliance_decryption.py decrypt --input-file <json_file>
+python scripts/compliance/decryption/main.py decrypt --input-file <json_file>
 ```
 
 **Requirements:**

scripts/compliance/decryption/main.py

@@ -3,7 +3,7 @@
 FromChat compliance decryption tool entrypoint.
 
 Run:
-    python scripts/compliance-decryption/main.py <command> ...
+    python scripts/compliance/decryption/main.py <command> ...
 """
 
 from __future__ import annotations

scripts/compliance/decryption/report_assets.py

@@ -8,7 +8,7 @@ def assets_source_dir() -> Path:
     Directory that stores static templates (css/js) for report generation.
 
     Layout:
-        scripts/compliance-decryption/
+        scripts/compliance/decryption/
             main.py
             assets/
                 report.css

scripts/compliance/keypair.py

@@ -7,7 +7,7 @@ The private key should be stored offline on an air-gapped machine.
 Only the public key is provided to the messaging service via COMPLIANCE_PUBLIC_KEY env var.
 
 Usage:
-    python3 scripts/generate_compliance_keypair.py
+    python3 scripts/compliance/keypair.py
 
 Output:
     - Prints the keypair to console
@@ -129,7 +129,7 @@ CONFIGURATION:
     # Handle file saving
     if args.save:
         script_dir = Path(__file__).parent
-        project_root = script_dir.parent
+        project_root = script_dir.parent.parent
         output_file = project_root / "compliance_keypair.txt"
         
         full_output = f"""COMPLIANCE SYSTEM X25519 KEYPAIR

scripts/generate:env.sh

@@ -169,7 +169,7 @@ _do_backup_copy() {
 run_gen_compliance() {
   local tmp
   tmp="$(mktemp "${TMPDIR:-/tmp}/fromchat-compliance.XXXXXX")"
-  "$VENV_PY" scripts/generate_compliance_keypair.py --emit-key-lines </dev/null >"$tmp"
+  "$VENV_PY" scripts/compliance/keypair.py --emit-key-lines </dev/null >"$tmp"
   {
     IFS= read -r _COMPLIANCE_PRIVATE_B64
     IFS= read -r _COMPLIANCE_PUBLIC_B64