refactor(backend): reorganize top-level layout

- ssh/ renamed to hosts/ (it covers SSH, RDP, VNC, Telnet, Docker, metrics)
- serial/serial.ts and guacamole/ moved inside hosts/
- dashboard.ts and homepage.ts moved to services/
- swagger.ts moved to utils/ with adjusted scan globs

Import paths and the generate:openapi script updated; ports and endpoints
unchanged.

src/backend/database/database.ts

@@ -11,7 +11,7 @@ import snippetsRoutes from "./routes/snippets.js";
 import c2sTunnelPresetRoutes from "./routes/c2s-tunnel-presets.js";
 import terminalRoutes from "./routes/terminal.js";
 import sessionLogRoutes from "./routes/session-log-routes.js";
-import guacamoleRoutes from "../guacamole/routes.js";
+import guacamoleRoutes from "../hosts/guacamole/routes.js";
 import networkTopologyRoutes from "./routes/network-topology.js";
 import rbacRoutes from "./routes/rbac.js";
 import openTabsRoutes from "./routes/open-tabs.js";

src/backend/database/routes/host-opkssh-routes.ts

@@ -52,7 +52,7 @@ export function registerHostOpksshRoutes(router: Router): void {
 
       try {
         const { getActiveAuthSession, registerOAuthState } =
-          await import("../../ssh/opkssh-auth.js");
+          await import("../../hosts/opkssh-auth.js");
         const session = getActiveAuthSession(requestId);
 
         if (!session) {
@@ -562,7 +562,7 @@ export function registerHostOpksshRoutes(router: Router): void {
         getActiveAuthSession,
         getRequestIdByOAuthState,
         clearOAuthState,
-      } = await import("../../ssh/opkssh-auth.js");
+      } = await import("../../hosts/opkssh-auth.js");
 
       const userId = await getUserIdFromRequest({
         cookies: req.cookies,
@@ -729,7 +729,7 @@ export function registerHostOpksshRoutes(router: Router): void {
 
       try {
         const { getActiveAuthSession } =
-          await import("../../ssh/opkssh-auth.js");
+          await import("../../hosts/opkssh-auth.js");
         const session = getActiveAuthSession(requestId);
 
         if (!session) {

src/backend/database/routes/host.ts

@@ -11,7 +11,7 @@ import { parseSSHKey } from "../../utils/ssh-key-utils.js";
 import {
   pickResolvedPassword,
   pickResolvedUsername,
-} from "../../ssh/credential-username.js";
+} from "../../hosts/credential-username.js";
 import {
   createCurrentCommandHistoryRepository,
   createCurrentFileManagerBookmarkRepository,
@@ -2252,7 +2252,7 @@ router.delete(
     }
 
     try {
-      const { deleteOPKSSHToken } = await import("../../ssh/opkssh-auth.js");
+      const { deleteOPKSSHToken } = await import("../../hosts/opkssh-auth.js");
       await deleteOPKSSHToken(userId, hostId);
       res.json({ success: true });
     } catch (error) {

src/backend/database/routes/open-tabs.ts

@@ -3,7 +3,7 @@ import express from "express";
 import type { Request, Response } from "express";
 import { databaseLogger } from "../../utils/logger.js";
 import { AuthManager } from "../../utils/auth-manager.js";
-import { sessionManager } from "../../ssh/terminal-session-manager.js";
+import { sessionManager } from "../../hosts/terminal-session-manager.js";
 import {
   getCurrentSettingValue,
   createCurrentOpenTabRepository,

src/backend/database/routes/proxmox.ts

@@ -9,7 +9,7 @@ import {
 import { AuthManager } from "../../utils/auth-manager.js";
 import type { AuthenticatedRequest } from "../../../types/index.js";
 import type { SSHHost } from "../../../types/index.js";
-import { SSHHostKeyVerifier } from "../../ssh/host-key-verifier.js";
+import { SSHHostKeyVerifier } from "../../hosts/host-key-verifier.js";
 
 const router = express.Router();
 const proxmoxLogger = logger;
@@ -402,7 +402,7 @@ async function discoverProxmoxGuestsForHost(
       sshConfig.passphrase = resolvedCredentials.keyPassword;
   } else if (authType === "agent") {
     const { applyAgentAuth } =
-      await import("../../ssh/terminal-auth-helpers.js");
+      await import("../../hosts/terminal-auth-helpers.js");
     const result = await applyAgentAuth(
       sshConfig,
       host.terminalConfig as unknown as Record<string, unknown> | undefined,

src/backend/database/routes/user-settings-routes.ts

@@ -1,6 +1,6 @@
 import type { AuthenticatedRequest } from "../../../types/index.js";
 import type { RequestHandler, Router } from "express";
-import { restartGuacServer } from "../../guacamole/guacamole-server.js";
+import { restartGuacServer } from "../../hosts/guacamole/guacamole-server.js";
 import {
   authLogger,
   getGlobalLogLevel,

src/backend/database/routes/vault.ts

@@ -8,7 +8,7 @@ import type { VaultProfileUpdateInput } from "../repositories/vault-profile-repo
 import type { AuthenticatedRequest } from "../../../types/index.js";
 import { authLogger } from "../../utils/logger.js";
 import { AuthManager } from "../../utils/auth-manager.js";
-import { completeVaultAuth } from "../../ssh/vault-oidc-auth.js";
+import { completeVaultAuth } from "../../hosts/vault-oidc-auth.js";
 
 const router = express.Router();
 

src/backend/hosts/guacamole/guacamole-server.ts

@@ -1,11 +1,11 @@
 import GuacamoleLite from "guacamole-lite";
-import { guacLogger } from "../utils/logger.js";
+import { guacLogger } from "../../utils/logger.js";
 import { GuacamoleTokenService } from "./token-service.js";
-import { getCurrentSettingValue } from "../database/repositories/factory.js";
-import { resolveGuacdOptions } from "../utils/guacd-config.js";
+import { getCurrentSettingValue } from "../../database/repositories/factory.js";
+import { resolveGuacdOptions } from "../../utils/guacd-config.js";
 import fs from "fs";
 import path from "path";
-import { createCurrentSessionRecordingRepository } from "../database/repositories/factory.js";
+import { createCurrentSessionRecordingRepository } from "../../database/repositories/factory.js";
 import type { GuacamoleRecordingMetadata } from "./token-service.js";
 
 const tokenService = GuacamoleTokenService.getInstance();

src/backend/hosts/guacamole/routes.ts

@@ -1,18 +1,18 @@
 import express from "express";
 import { GuacamoleTokenService } from "./token-service.js";
-import { guacLogger } from "../utils/logger.js";
-import { AuthManager } from "../utils/auth-manager.js";
-import { PermissionManager } from "../utils/permission-manager.js";
+import { guacLogger } from "../../utils/logger.js";
+import { AuthManager } from "../../utils/auth-manager.js";
+import { PermissionManager } from "../../utils/permission-manager.js";
 import { Client } from "ssh2";
 import net from "net";
 import crypto from "crypto";
 import path from "path";
-import type { AuthenticatedRequest } from "../../types/index.js";
+import type { AuthenticatedRequest } from "../../../types/index.js";
 import {
   createCurrentHostResolutionRepository,
   createCurrentSettingsRepository,
-} from "../database/repositories/factory.js";
-import { resolveGuacdOptions } from "../utils/guacd-config.js";
+} from "../../database/repositories/factory.js";
+import { resolveGuacdOptions } from "../../utils/guacd-config.js";
 
 const router = express.Router();
 const tokenService = GuacamoleTokenService.getInstance();
@@ -422,7 +422,7 @@ router.post(
 
       if (jumpHosts.length > 0) {
         try {
-          const { resolveHostById } = await import("../ssh/host-resolver.js");
+          const { resolveHostById } = await import("../host-resolver.js");
           const jumpHost = await resolveHostById(jumpHosts[0].hostId, userId);
           if (jumpHost) {
             const tunnelPort = await new Promise<number>((resolve, reject) => {

src/backend/hosts/guacamole/token-service.test.ts

@@ -1,6 +1,6 @@
 import { describe, expect, it, vi } from "vitest";
 
-vi.mock("../utils/logger.js", () => ({
+vi.mock("../../utils/logger.js", () => ({
   guacLogger: {
     debug: vi.fn(),
     info: vi.fn(),

src/backend/hosts/guacamole/token-service.ts

@@ -1,5 +1,5 @@
 import crypto from "crypto";
-import { guacLogger } from "../utils/logger.js";
+import { guacLogger } from "../../utils/logger.js";
 
 export interface GuacamoleConnectionSettings {
   type: "rdp" | "vnc" | "telnet";