refactor: organize API routers and services into subpackages

Service organization (19 files moved into 6 subpackages):
- services/instance/ — event_bus, health_monitor, lifecycle_hooks
- services/config/ — config_profile_resolver
- services/git/ — clone, git_operations, git_service
- services/build/ — docker_build, manifest_compiler
- services/terminal/ — terminal_manager, terminal_session
- services/shared/ — correlation, file_service, notification_service,
  permission_fixer, readiness_probe, ssh_keys, tunnel, workspace_manager

API router organization (16 files moved into 6 subpackages):
- api/tool/ — tool_instances, tool_types, tool_definitions,
  tool_types_validation, sessions (extracted from tool_instances)
- api/config/ — config_profiles, user_config
- api/workspace/ — workspaces, workspace_files, workspace_git,
  workspace_instances
- api/user/ — users, auth, ssh_keys
- api/project/ — projects, git_repositories
- api/system/ — health, events, notifications, dashboard, terminal,
  instance_proxy

Updated main.py imports and all __init__.py re-exports.
Sessions router extracted from tool_instances.py into api/tool/sessions.py.

Quality gates: py_compile passed, ruff passed.

apps/api/src/services/config/__init__.py

@@ -1 +1,25 @@
-"""Config module."""
+"""Config profile services module."""
+
+from src.services.config.config_profile_resolver import (
+    ConfigProfileCycleError,
+    ConfigProfileNotFoundError,
+    ResolvedMount,
+    ResolvedProfile,
+    apply_resolved_profile,
+    check_include_cycle,
+    expand_container_path,
+    resolve_profile,
+    resolved_profile_to_dict,
+)
+
+__all__ = [
+    "ConfigProfileCycleError",
+    "ConfigProfileNotFoundError",
+    "ResolvedMount",
+    "ResolvedProfile",
+    "apply_resolved_profile",
+    "check_include_cycle",
+    "expand_container_path",
+    "resolve_profile",
+    "resolved_profile_to_dict",
+]

apps/api/src/services/git/__init__.py

@@ -1 +1,19 @@
-"""Git module."""
+"""Git services module."""
+
+from src.services.git.clone import (
+    check_dirty_state,
+    clone_repository,
+    remove_clone_directory,
+)
+from src.services.git.git_operations import Commit, GitOperations, GitStatus
+from src.services.git.git_service import GitService
+
+__all__ = [
+    "check_dirty_state",
+    "clone_repository",
+    "remove_clone_directory",
+    "Commit",
+    "GitOperations",
+    "GitStatus",
+    "GitService",
+]

apps/api/src/services/instance/__init__.py

@@ -1 +1,7 @@
-"""Instance module."""
+"""Instance lifecycle services module."""
+
+from src.services.instance.event_bus import InstanceEventBus
+from src.services.instance.health_monitor import HealthMonitor
+from src.services.instance.lifecycle_hooks import publish_lifecycle_event
+
+__all__ = ["InstanceEventBus", "HealthMonitor", "publish_lifecycle_event"]

apps/api/src/services/instance/health_monitor.py

@@ -12,11 +12,11 @@ from sqlalchemy.ext.asyncio import AsyncSession
 from src.database import SessionLocal
 from src.models import HealthCheck
 from src.models import ToolInstance
-from src.services.correlation import get_correlation_id
+from src.services.shared.correlation import get_correlation_id
 from src.services.docker import get_container_status
-from src.services.tunnel import check_tunnel_health
-from src.services.event_bus import InstanceEventBus, InstanceEventPayload
-from src.services.notification_service import notification_service
+from src.services.shared.tunnel import check_tunnel_health
+from src.services.instance.event_bus import InstanceEventBus, InstanceEventPayload
+from src.services.shared.notification_service import notification_service
 
 logger = logging.getLogger(__name__)
 

apps/api/src/services/instance/lifecycle_hooks.py

@@ -8,9 +8,9 @@ from sqlalchemy.ext.asyncio import AsyncSession
 
 from src.models import InstanceEvent
 from src.models import ToolInstance
-from src.services.correlation import get_correlation_id
-from src.services.event_bus import InstanceEventBus, InstanceEventPayload
-from src.services.notification_service import notification_service
+from src.services.shared.correlation import get_correlation_id
+from src.services.instance.event_bus import InstanceEventBus, InstanceEventPayload
+from src.services.shared.notification_service import notification_service
 
 logger = logging.getLogger(__name__)
 

apps/api/src/services/shared/__init__.py

@@ -1 +1,51 @@
-"""Shared module."""
+"""Shared services module."""
+
+from src.services.shared.correlation import CorrelationIdMiddleware, get_correlation_id
+from src.services.shared.file_service import FileEntry, FileService
+from src.services.shared.notification_service import NotificationService
+from src.services.shared.permission_fixer import (
+    PermissionFixError,
+    apply_mount_permissions,
+    apply_ssh_permissions,
+    check_root_user_available,
+)
+from src.services.shared.readiness_probe import execute_probe
+from src.services.shared.ssh_keys import (
+    cleanup_ssh_key_files,
+    prepare_ssh_key_files,
+    write_ssh_config,
+)
+from src.services.shared.tunnel import (
+    check_tunnel_health,
+    recreate_tunnel,
+    start_tunnel,
+    stop_tunnel,
+)
+from src.services.shared.workspace_manager import (
+    SyncResult,
+    WorkspaceHasInstancesError,
+    WorkspaceManager,
+)
+
+__all__ = [
+    "CorrelationIdMiddleware",
+    "FileEntry",
+    "FileService",
+    "NotificationService",
+    "PermissionFixError",
+    "SyncResult",
+    "WorkspaceHasInstancesError",
+    "WorkspaceManager",
+    "apply_mount_permissions",
+    "apply_ssh_permissions",
+    "check_root_user_available",
+    "check_tunnel_health",
+    "cleanup_ssh_key_files",
+    "execute_probe",
+    "get_correlation_id",
+    "prepare_ssh_key_files",
+    "recreate_tunnel",
+    "start_tunnel",
+    "stop_tunnel",
+    "write_ssh_config",
+]

apps/api/src/services/shared/workspace_manager.py

@@ -15,8 +15,8 @@ from typing import TYPE_CHECKING
 from sqlalchemy import select
 
 from src.models import Workspace
-from src.services.git_service import GitService
-from src.services.ssh_keys import _get_fernet
+from src.services.git.git_service import GitService
+from src.services.shared.ssh_keys import _get_fernet
 
 if TYPE_CHECKING:
     from sqlalchemy.ext.asyncio import AsyncSession

apps/api/src/services/terminal/__init__.py

@@ -1 +1,9 @@
-"""Terminal module."""
+"""Terminal services module."""
+
+from src.services.terminal.terminal_manager import (
+    MaxSessionsExceededError,
+    TerminalManager,
+)
+from src.services.terminal.terminal_session import TerminalSession
+
+__all__ = ["MaxSessionsExceededError", "TerminalManager", "TerminalSession"]

apps/api/src/services/terminal/terminal_manager.py

@@ -10,7 +10,7 @@ from sqlalchemy.dialects.postgresql import insert as pg_insert
 
 from src.database import SessionLocal
 from src.models import TerminalSessionModel
-from src.services.terminal_session import TerminalSession
+from src.services.terminal.terminal_session import TerminalSession
 
 logger = logging.getLogger(__name__)