refactor: reorganize models into subpackages

Move models into domain subpackages (max 4 files each):
- models/tool/ — tool_type, tool_instance, tool_definition_manifest
- models/config/ — config_profile
- models/user/ — user, user_config, ssh_key
- models/project/ — project, git_repository, workspace
- models/system/ — health_check, notification, instance_event, terminal_session

models/__init__.py continues to re-export all symbols, so consumers
using 'from src.models import X' are unaffected. Updated direct file
imports across the backend to use the new paths.

Quality gates: py_compile passed, ruff passed.

apps/api/src/models/project/__init__.py

@@ -0,0 +1,7 @@
+"""Project models module."""
+
+from src.models.project.git_repository import GitRepository
+from src.models.project.project import Project
+from src.models.project.workspace import Workspace
+
+__all__ = ["GitRepository", "Project", "Workspace"]

apps/api/src/models/project/git_repository.py

@@ -0,0 +1,33 @@
+import uuid
+from datetime import datetime
+from typing import TYPE_CHECKING
+
+from sqlalchemy import Boolean, DateTime, ForeignKey, String
+from sqlalchemy import Uuid as UUID
+from sqlalchemy.orm import Mapped, mapped_column, relationship
+
+from src.models.base import Base, TimestampMixin, UUIDPrimaryKeyMixin
+
+if TYPE_CHECKING:
+    from src.models.project import Project
+    from src.models import SSHKey
+    from src.models.user import User
+
+
+class GitRepository(UUIDPrimaryKeyMixin, TimestampMixin, Base):
+    __tablename__ = "git_repositories"
+
+    name: Mapped[str] = mapped_column(String(255))
+    path: Mapped[str] = mapped_column(String(1024))
+    project_id: Mapped[uuid.UUID | None] = mapped_column(UUID(), ForeignKey("projects.id"), nullable=True)
+    owner_id: Mapped[uuid.UUID] = mapped_column(UUID(), ForeignKey("users.id"), nullable=False)
+    is_mirror: Mapped[bool] = mapped_column(Boolean, default=False, nullable=False)
+    remote_url: Mapped[str | None] = mapped_column(String(1024), nullable=True)
+    last_push: Mapped[datetime | None] = mapped_column(DateTime(timezone=True), nullable=True)
+    ssh_key_id: Mapped[uuid.UUID | None] = mapped_column(
+        UUID(), ForeignKey("ssh_keys.id"), nullable=True
+    )
+
+    project: Mapped["Project"] = relationship(back_populates="repositories")
+    owner: Mapped["User"] = relationship()
+    ssh_key: Mapped["SSHKey | None"] = relationship()

apps/api/src/models/project/project.py

@@ -0,0 +1,31 @@
+import uuid
+from typing import TYPE_CHECKING
+
+from sqlalchemy import ForeignKey, String, Text
+from sqlalchemy import Uuid as UUID
+from sqlalchemy.orm import Mapped, mapped_column, relationship
+
+from src.models.base import Base, TimestampMixin, UUIDPrimaryKeyMixin
+
+if TYPE_CHECKING:
+    from src.models import GitRepository
+    from src.models import SSHKey
+    from src.models.user import User
+
+
+class Project(UUIDPrimaryKeyMixin, TimestampMixin, Base):
+    __tablename__ = "projects"
+
+    name: Mapped[str] = mapped_column(String(255))
+    description: Mapped[str | None] = mapped_column(Text, nullable=True)
+    owner_id: Mapped[uuid.UUID] = mapped_column(UUID(), ForeignKey("users.id"), nullable=False)
+    default_ssh_key_id: Mapped[uuid.UUID | None] = mapped_column(
+        UUID(),
+        ForeignKey("ssh_keys.id"),
+        nullable=True,
+    )
+
+    owner: Mapped["User"] = relationship(back_populates="projects")
+    repositories: Mapped[list["GitRepository"]] = relationship(back_populates="project")
+    default_ssh_key: Mapped["SSHKey | None"] = relationship(foreign_keys=[default_ssh_key_id])
+    ssh_keys: Mapped[list["SSHKey"]] = relationship(back_populates="project", foreign_keys="SSHKey.project_id")

apps/api/src/models/project/workspace.py

@@ -0,0 +1,50 @@
+"""Workspace model for persistent writable repo clones."""
+
+from __future__ import annotations
+
+import uuid
+from datetime import datetime
+from typing import TYPE_CHECKING
+
+from sqlalchemy import DateTime, ForeignKey, String, UniqueConstraint
+from sqlalchemy.orm import Mapped, mapped_column, relationship
+
+from src.models.base import Base, TimestampMixin
+
+if TYPE_CHECKING:
+    from src.models import GitRepository
+    from src.models.user import User
+
+
+class Workspace(Base, TimestampMixin):
+    """A persistent, writable local clone of a Git repository.
+
+    Users create workspaces explicitly, then start tool instances on them.
+    Multiple tool instances can share the same workspace.
+    """
+
+    __tablename__ = "workspaces"
+
+    id: Mapped[uuid.UUID] = mapped_column(primary_key=True, default=uuid.uuid4)
+    name: Mapped[str] = mapped_column(String(255), nullable=False)
+    repo_id: Mapped[uuid.UUID] = mapped_column(
+        ForeignKey("git_repositories.id", ondelete="CASCADE"),
+        nullable=False,
+    )
+    user_id: Mapped[uuid.UUID] = mapped_column(
+        ForeignKey("users.id", ondelete="CASCADE"),
+        nullable=False,
+    )
+    branch: Mapped[str] = mapped_column(String(255), nullable=False, default="main")
+    path: Mapped[str] = mapped_column(String(2048), nullable=False)
+    status: Mapped[str] = mapped_column(String(16), nullable=False, default="ready")
+    last_sync_at: Mapped[datetime | None] = mapped_column(
+        DateTime(timezone=True), nullable=True
+    )
+
+    __table_args__ = (
+        UniqueConstraint("repo_id", "name", name="uq_workspace_repo_name"),
+    )
+
+    repository: Mapped[GitRepository] = relationship("GitRepository")
+    owner: Mapped[User] = relationship("User")