refactor(hosts): group host modules into per-feature directories

file-manager/, metrics/ (incl. widgets, managers, alert-engine),
terminal/, tmux/ and tunnel/ each own their files; docker/ gains
container-runtime. Genuinely shared helpers (jump-host chain, host
resolver, connection pool, opkssh, vault, serial) stay at hosts/ root.
Pure file moves with import path updates; mirrored test paths follow.

src/backend/tests/hosts/file-manager/operation-commands.test.ts

@@ -1,6 +1,6 @@
 import { describe, expect, it } from "vitest";
 
-import { buildDeleteCommand } from "../../hosts/file-manager-operation-commands.js";
+import { buildDeleteCommand } from "../../../hosts/file-manager/operation-commands.js";
 
 describe("buildDeleteCommand", () => {
   it("builds a PowerShell 5.1 compatible delete command for Windows files", () => {

src/backend/tests/hosts/file-manager/utils.test.ts

@@ -6,7 +6,7 @@ import {
   getMimeType,
   detectBinary,
   parseLsDateToTimestamp,
-} from "../../hosts/file-manager-utils.js";
+} from "../../../hosts/file-manager/utils.js";
 
 describe("isExecutableFile", () => {
   it("flags scripts with execute permission", () => {

src/backend/tests/hosts/managers/managers.test.ts

@@ -2,8 +2,8 @@ import { describe, it, expect } from "vitest";
 import {
   buildSudoCommand,
   shellSingleQuote,
-} from "../../../hosts/managers/exec-elevated.js";
-import { parsePlatformProbe } from "../../../hosts/managers/platform.js";
+} from "../../../hosts/metrics/managers/exec-elevated.js";
+import { parsePlatformProbe } from "../../../hosts/metrics/managers/platform.js";
 import {
   isValidSystemdUnit,
   isValidPid,
@@ -15,47 +15,53 @@ import {
   isValidSignal,
   isValidServiceAction,
   isAllowedPath,
-} from "../../../hosts/managers/validation.js";
+} from "../../../hosts/metrics/managers/validation.js";
 import {
   parseServiceList,
   buildServiceActionCommand,
-} from "../../../hosts/managers/services.js";
+} from "../../../hosts/metrics/managers/services.js";
 import {
   parseProcessList,
   buildKillCommand,
-} from "../../../hosts/managers/processes.js";
+} from "../../../hosts/metrics/managers/processes.js";
 import {
   parseDfMounts,
   parseTopMemory,
-} from "../../../hosts/managers/simple-reads.js";
+} from "../../../hosts/metrics/managers/simple-reads.js";
 import {
   parseCrontab,
   serializeCrontab,
   isValidCronSchedule,
   buildApplyCrontabCommand,
-} from "../../../hosts/managers/cron.js";
+} from "../../../hosts/metrics/managers/cron.js";
 import {
   buildPackageActionCommand,
   parseUpgradable,
   buildListUpgradableCommand,
-} from "../../../hosts/managers/packages.js";
+} from "../../../hosts/metrics/managers/packages.js";
 import {
   buildIssueCommand,
   buildRenewCommand,
   buildRevokeCommand,
   isValidCertName,
   parseCertbotCertificates,
-} from "../../../hosts/managers/ssl.js";
+} from "../../../hosts/metrics/managers/ssl.js";
 import {
   buildIptablesRuleCommand,
   buildNftRuleCommand,
-} from "../../../hosts/managers/firewall.js";
-import { parsePasswd, parseSudoers } from "../../../hosts/managers/users.js";
+} from "../../../hosts/metrics/managers/firewall.js";
+import {
+  parsePasswd,
+  parseSudoers,
+} from "../../../hosts/metrics/managers/users.js";
 import {
   buildHealthCheckCommand,
   parseHealthResult,
-} from "../../../hosts/managers/health.js";
-import { buildTailCommand, clampLines } from "../../../hosts/managers/logs.js";
+} from "../../../hosts/metrics/managers/health.js";
+import {
+  buildTailCommand,
+  clampLines,
+} from "../../../hosts/metrics/managers/logs.js";
 
 describe("exec-elevated", () => {
   it("single-quotes and escapes for the shell", () => {

src/backend/tests/hosts/metrics/helpers.test.ts

@@ -4,8 +4,8 @@ import {
   supportsMetrics,
   isTcpPingEnabled,
   tcpPingThroughJumpHost,
-} from "../../hosts/host-metrics-helpers.js";
-import { createConnectionLog } from "../../hosts/connection-log.js";
+} from "../../../hosts/metrics/helpers.js";
+import { createConnectionLog } from "../../../hosts/connection-log.js";
 
 describe("supportsMetrics", () => {
   it("supports plain ssh hosts", () => {

src/backend/tests/hosts/metrics/managers/exec-elevated.test.ts

@@ -1,14 +1,14 @@
 import { describe, it, expect, vi, beforeEach } from "vitest";
 
 const execCommand = vi.fn();
-vi.mock("../../../hosts/widgets/common-utils.js", () => ({
+vi.mock("../../../../hosts/metrics/widgets/common-utils.js", () => ({
   execCommand: (...args: unknown[]) => execCommand(...args),
 }));
 
 import {
   execElevated,
   ElevationError,
-} from "../../../hosts/managers/exec-elevated.js";
+} from "../../../../hosts/metrics/managers/exec-elevated.js";
 import type { Client } from "ssh2";
 
 const fakeClient = {} as Client;

src/backend/tests/hosts/metrics/state.test.ts

@@ -2,7 +2,7 @@ import { describe, expect, it, vi } from "vitest";
 import {
   ConcurrentLimiter,
   HostPollCache,
-} from "../../hosts/host-metrics-state.js";
+} from "../../../hosts/metrics/state.js";
 
 describe("ConcurrentLimiter", () => {
   it("never exceeds max concurrent runners", async () => {

src/backend/tests/hosts/metrics/widgets/common-utils.test.ts

@@ -1,5 +1,8 @@
 import { describe, it, expect } from "vitest";
-import { toFixedNum, kibToGiB } from "../../../hosts/widgets/common-utils.js";
+import {
+  toFixedNum,
+  kibToGiB,
+} from "../../../../hosts/metrics/widgets/common-utils.js";
 
 describe("toFixedNum", () => {
   it("rounds to the requested digit count", () => {

src/backend/tests/hosts/metrics/widgets/cpu-collector.test.ts

@@ -1,5 +1,5 @@
 import { describe, it, expect } from "vitest";
-import { parseCpuLine } from "../../../hosts/widgets/cpu-collector.js";
+import { parseCpuLine } from "../../../../hosts/metrics/widgets/cpu-collector.js";
 
 describe("parseCpuLine", () => {
   it("parses a standard /proc/stat cpu line", () => {

src/backend/tests/hosts/metrics/widgets/temperature-collector.test.ts

@@ -2,7 +2,7 @@ import { describe, expect, it } from "vitest";
 import {
   parseSensorsOutput,
   parseSysfsThermalOutput,
-} from "../../../hosts/widgets/temperature-collector.js";
+} from "../../../../hosts/metrics/widgets/temperature-collector.js";
 
 describe("temperature collectors", () => {
   it("parses sysfs thermal zone output", () => {

src/backend/tests/hosts/terminal/session-manager.test.ts

@@ -4,18 +4,18 @@ import { describe, it, expect, vi, beforeEach } from "vitest";
 const mockCreate = vi.fn().mockResolvedValue({ id: 1 });
 const mockUpdateEnded = vi.fn().mockResolvedValue(undefined);
 
-vi.mock("../../database/db/index.js", () => ({
+vi.mock("../../../database/db/index.js", () => ({
   getDb: () => ({}),
 }));
 
-vi.mock("../../database/repositories/factory.js", () => ({
+vi.mock("../../../database/repositories/factory.js", () => ({
   createCurrentSessionRecordingRepository: () => ({
     create: mockCreate,
     updateEnded: mockUpdateEnded,
   }),
 }));
 
-vi.mock("../../utils/logger.js", () => ({
+vi.mock("../../../utils/logger.js", () => ({
   sshLogger: {
     info: vi.fn(),
     warn: vi.fn(),
@@ -50,7 +50,7 @@ vi.mock("fs", () => ({
 }));
 
 const { sessionManager } =
-  await import("../../hosts/terminal-session-manager.js");
+  await import("../../../hosts/terminal/session-manager.js");
 
 describe("TerminalSessionManager - session logging", () => {
   beforeEach(() => {

src/backend/tests/hosts/tmux/helper.test.ts

@@ -5,7 +5,7 @@ import {
   detectTmux,
   tmuxCommand,
   withTmuxPath,
-} from "../../hosts/tmux-helper.js";
+} from "../../../hosts/tmux/helper.js";
 
 describe("tmux command path handling", () => {
   it("adds common non-login shell tmux paths", () => {

src/backend/tests/hosts/tmux/monitor-helpers.test.ts

@@ -9,7 +9,7 @@ import {
   buildPaneMetrics,
   attachPanesToWindows,
   shellEscape,
-} from "../../hosts/tmux-monitor-helpers.js";
+} from "../../../hosts/tmux/monitor-helpers.js";
 
 function join(...fields: (string | number)[]): string {
   return fields.join(SEP);