Organize src/ into concern folders (http, auth, admin, plugin-host, ui); co-locate tests, move plugin-api barrel into plugin-host, sync docs + AGENTS layout

views/admin/clients.ejs

@@ -1,6 +1,6 @@
 <%#
   OAuth2 clients admin list: apps that log in *through* us (Hydra). Same building blocks as
-  the Roles screen, around the shell, backed by live Hydra OAuth2 clients (src/admin-clients.ts).
+  the Roles screen, around the shell, backed by live Hydra OAuth2 clients (src/admin/admin-clients.ts).
 %><%
   const nav = include("partials/nav-tree", { nodes: model.nav });
   const filters = include("partials/filter-bar", model.filterBar);

views/admin/groups.ejs

@@ -1,6 +1,6 @@
 <%#
   Groups admin list: the same building blocks as the Users screen, around the shell, but
-  backed by live Keto subject sets (src/admin-groups.ts). Filter/sort/page round-trip the URL.
+  backed by live Keto subject sets (src/admin/admin-groups.ts). Filter/sort/page round-trip the URL.
 %><%
   const nav = include("partials/nav-tree", { nodes: model.nav });
   const filters = include("partials/filter-bar", model.filterBar);

views/admin/roles.ejs

@@ -1,6 +1,6 @@
 <%#
   Roles admin list: the same building blocks as the Groups screen, around the shell, backed
-  by live Keto Role subject sets (src/admin-roles.ts). Filter/sort/page round-trip the URL.
+  by live Keto Role subject sets (src/admin/admin-roles.ts). Filter/sort/page round-trip the URL.
 %><%
   const nav = include("partials/nav-tree", { nodes: model.nav });
   const filters = include("partials/filter-bar", model.filterBar);

views/admin/users.ejs

@@ -1,6 +1,6 @@
 <%#
   Users admin list: the same building blocks as the dashboard, around the shell, but
-  backed by live Kratos identities (src/admin-users.ts). Filter/sort/page all round-trip the URL.
+  backed by live Kratos identities (src/admin/admin-users.ts). Filter/sort/page all round-trip the URL.
 %><%
   const nav = include("partials/nav-tree", { nodes: model.nav });
   const filters = include("partials/filter-bar", model.filterBar);

views/auth.ejs

@@ -1,6 +1,6 @@
 <%#
   Themed Kratos self-service page inside the unified app shell: sign-in / register /
-  reset / verify / settings. Renders a FlowView (src/flow-view.ts) into the shell content, reusing the
+  reset / verify / settings. Renders a FlowView (src/auth/flow-view.ts) into the shell content, reusing the
   auth-card + field partials. The form posts straight to flow.ui.action — Kratos owns its CSRF. The
   shell's menu is role-filtered (anonymous ⇒ public items + Sign in); the topbar carries no heading,
   so the card's own <h1> is the page's single heading. Data: chrome (PageChrome), flow (FlowView).

views/partials/flow-body.ejs

@@ -1,7 +1,7 @@
 <%#
   Kratos flow form body: the inner of the auth-card form — flow messages,
   hidden inputs (incl. csrf_token), themed fields, then submit button(s). `flow` is a
-  FlowView (src/flow-view.ts). Captured by views/auth.ejs and handed to auth-card's body.
+  FlowView (src/auth/flow-view.ts). Captured by views/auth.ejs and handed to auth-card's body.
 -%>
 <% flow.messages.forEach((m) => { -%>
 <%- include("alert", m) %>

views/partials/icons.ejs

@@ -1,4 +1,4 @@
-<%# Generated from lucide-static by src/icons.ts — regenerate on dep bump (guarded by icons.test.ts). %>
+<%# Generated from lucide-static by src/ui/icons.ts — regenerate on dep bump (guarded by icons.test.ts). %>
 <svg width="0" height="0" style="position:absolute" aria-hidden="true" focusable="false">
   <symbol id="i-alert" viewBox="0 0 24 24"><circle cx="12" cy="12" r="10" /><line x1="12" x2="12" y1="8" y2="12" /><line x1="12" x2="12.01" y1="16" y2="16" /></symbol>
   <symbol id="i-arrow-left" viewBox="0 0 24 24"><path d="m12 19-7-7 7-7" /><path d="M19 12H5" /></symbol>