refactor: organize API routers and services into subpackages

Service organization (19 files moved into 6 subpackages):
- services/instance/ — event_bus, health_monitor, lifecycle_hooks
- services/config/ — config_profile_resolver
- services/git/ — clone, git_operations, git_service
- services/build/ — docker_build, manifest_compiler
- services/terminal/ — terminal_manager, terminal_session
- services/shared/ — correlation, file_service, notification_service,
  permission_fixer, readiness_probe, ssh_keys, tunnel, workspace_manager

API router organization (16 files moved into 6 subpackages):
- api/tool/ — tool_instances, tool_types, tool_definitions,
  tool_types_validation, sessions (extracted from tool_instances)
- api/config/ — config_profiles, user_config
- api/workspace/ — workspaces, workspace_files, workspace_git,
  workspace_instances
- api/user/ — users, auth, ssh_keys
- api/project/ — projects, git_repositories
- api/system/ — health, events, notifications, dashboard, terminal,
  instance_proxy

Updated main.py imports and all __init__.py re-exports.
Sessions router extracted from tool_instances.py into api/tool/sessions.py.

Quality gates: py_compile passed, ruff passed.

progress.md

@@ -1,30 +1,10 @@
 # Progress
 
 ## Status
-In Progress — Backend structural refactoring
+In Progress
 
 ## Tasks
-- [x] Phase 0: Create submodule directory structure (__init__.py files)
-- [x] Phase 1: Model subpackages (tool, config, user, project, system)
-- [x] Phase 2: Docker service package split (compose, container, config_staging, tunnel)
-- [ ] Phase 3: Service subpackages (instance, config, git, build, terminal, shared)
-- [ ] Phase 4: Schema extraction (tool, config, user, project, system)
-- [ ] Phase 5: API router subpackages (tool, config, workspace, user, project, system)
-- [ ] Phase 6: Auth dependency refactor
-- [ ] Phase 7: Frontend reorganization
-- [ ] Phase 8: Integration and verification
 
 ## Files Changed
-- `apps/api/src/services/docker.py` → deleted (split into package)
-- `apps/api/src/services/docker/__init__.py` — re-exports all public functions
-- `apps/api/src/services/docker/compose.py` — compose generation & commands
-- `apps/api/src/services/docker/container.py` — container runtime queries
-- `apps/api/src/services/docker/config_staging.py` — file staging into instances
-- `apps/api/src/services/docker/tunnel.py` — cloudflared tunnel lifecycle
-- `apps/api/src/services/tunnel.py` — thin backward-compat re-export wrapper
 
 ## Notes
-- All backward-compatible imports preserved via __init__.py re-exports
-- `from src.services.docker import X` continues to work for all previously exported symbols
-- `from src.services.tunnel import X` continues to work via re-export wrapper
-- No behavior changes, pure structural refactor