refactor: move API routers into domain subpackages

Moves 21 API router files into 6 domain subpackages (max 6 files each):
- api/tool/ — tool_instances, tool_types, tool_definitions, sessions
- api/config/ — config_profiles, user_config
- api/workspace/ — workspaces, workspace_files, workspace_git, workspace_instances
- api/user/ — users, auth, ssh_keys
- api/project/ — projects, git_repositories
- api/system/ — health, events, notifications, dashboard, terminal, instance_proxy

sessions_router extracted from tool_instances.py into tool/sessions.py.

main.py now imports from subpackage __init__.py re-exports.
Cross-router imports updated to use new paths.
Fixed pre-existing E712 in tool_definitions.py (is_base == False → is_(False)).

Quality gates: py_compile passed on all files, ruff passed.

apps/api/src/api/tool/tool_definitions.py

@@ -173,7 +173,7 @@ async def list_tool_definitions(
     """
     query = select(ToolDefinitionManifest)
     if not include_bases:
-        query = query.where(ToolDefinitionManifest.is_base == False)
+        query = query.where(ToolDefinitionManifest.is_base.is_(False))
 
     result = await session.execute(
         query.order_by(ToolDefinitionManifest.created_at.desc())

apps/api/src/api/tool/tool_instances.py

@@ -30,7 +30,6 @@ from src.services.instance.event_bus import InstanceEventBus
 from src.services.instance.lifecycle_hooks import publish_lifecycle_event
 from src.models import ConfigProfile
 from src.models import GitRepository
-from src.models.project import Project
 from src.models import SSHKey
 from src.models import ToolInstance
 from src.models import ToolType

progress.md

@@ -1,10 +1,52 @@
-# Progress
+# Progress — Backend-Frontend Refactoring
 
-## Status
+## Completed
-In Progress
 
-## Tasks
+### Phase 0: Submodule Infrastructure
+- [x] Created all directory structures with __init__.py files
 
-## Files Changed
+### Phase 1: Model Subpackages
+- [x] Moved models into domain subpackages (5 subpackages, ≤4 files each)
+- [x] Updated models/__init__.py with re-exports
+- [x] Updated all imports across backend
+- [x] Committed: `0591b00`
 
-## Notes
+### Phase 2: Schema Extraction
+- [x] Extracted Pydantic schemas from 9 API routers into schemas/ subpackages
+- [x] Updated all API routers to import from src.schemas.*
+- [x] Committed: `8816ee0`
+
+### Phase 3: Docker Service Split
+- [x] Split services/docker.py into services/docker/ package (4 modules)
+- [x] Created re-export wrapper in services/tunnel.py
+- [x] Committed: `6104f59`
+
+### Phase 4: Service + API Router Subpackages
+- [x] Moved 19 service files into 6 subpackages with re-exports
+- [x] Moved 16 API router files into 6 subpackages with re-exports
+- [x] Extracted sessions router from tool_instances.py into api/tool/sessions.py
+- [x] Updated main.py imports
+- [x] Committed locally: `37ccaa4` (needs push)
+
+## Pending Push
+- Commit `37ccaa4` is ready locally on `dev` but not yet pushed to origin
+- Run: `cd /home/alex/projects/headquarter && git push origin dev`
+
+## Remaining Phases
+
+### Phase 5: Auth Dependency Refactor
+- [ ] Add get_current_user to auth/dependencies.py
+- [ ] Migrate routers to use get_current_user where appropriate
+
+### Phase 6: Frontend Reorganization
+- [ ] Rename API files to kebab-case
+- [ ] Rename page files to *Page.tsx
+- [ ] Move components into features/ directories
+
+### Phase 7: Integration and Verification
+- [ ] Run backend tests
+- [ ] Run frontend typecheck + build
+- [ ] Verify docker compose up --build
+
+## Current Branch
+- `dev` with local commits ahead of origin/dev