refactor(backend): reorganize top-level layout

- ssh/ renamed to hosts/ (it covers SSH, RDP, VNC, Telnet, Docker, metrics)
- serial/serial.ts and guacamole/ moved inside hosts/
- dashboard.ts and homepage.ts moved to services/
- swagger.ts moved to utils/ with adjusted scan globs

Import paths and the generate:openapi script updated; ports and endpoints
unchanged.

src/backend/hosts/vault-ssh-connect.ts

@@ -0,0 +1,39 @@
+import type { Client, ConnectConfig } from "ssh2";
+
+type VaultAuthHost = {
+  id: number;
+  username: string;
+  userId?: string | null;
+  vaultProfile?: { id?: number | null } | null;
+};
+
+export async function setupVaultSshSignerAuth(
+  config: ConnectConfig,
+  client: Client,
+  host: VaultAuthHost,
+): Promise<void> {
+  if (!host.userId) {
+    throw new Error("Vault SSH signer authentication requires a user session");
+  }
+
+  const vaultProfileId = host.vaultProfile?.id;
+  if (!vaultProfileId) {
+    throw new Error("Host has no Vault signer profile configured");
+  }
+
+  const { getVaultCert } = await import("./vault-signer-auth.js");
+  const cert = await getVaultCert(host.userId, vaultProfileId);
+  if (!cert) {
+    throw new Error(
+      "Vault SSH signer authentication required. Please open a Terminal connection first.",
+    );
+  }
+
+  const { setupOPKSSHCertAuth } = await import("./opkssh-cert-auth.js");
+  await setupOPKSSHCertAuth(
+    config,
+    client,
+    { privateKey: cert.privateKey, sshCert: cert.sshCert },
+    host.username,
+  );
+}