Organize src/ into concern folders (http, auth, admin, plugin-host, ui); co-locate tests, move plugin-api barrel into plugin-host, sync docs + AGENTS layout

views/partials/flow-body.ejs

@@ -1,7 +1,7 @@
 <%#
   Kratos flow form body: the inner of the auth-card form — flow messages,
   hidden inputs (incl. csrf_token), themed fields, then submit button(s). `flow` is a
-  FlowView (src/flow-view.ts). Captured by views/auth.ejs and handed to auth-card's body.
+  FlowView (src/auth/flow-view.ts). Captured by views/auth.ejs and handed to auth-card's body.
 -%>
 <% flow.messages.forEach((m) => { -%>
 <%- include("alert", m) %>

views/partials/icons.ejs

@@ -1,4 +1,4 @@
-<%# Generated from lucide-static by src/icons.ts — regenerate on dep bump (guarded by icons.test.ts). %>
+<%# Generated from lucide-static by src/ui/icons.ts — regenerate on dep bump (guarded by icons.test.ts). %>
 <svg width="0" height="0" style="position:absolute" aria-hidden="true" focusable="false">
   <symbol id="i-alert" viewBox="0 0 24 24"><circle cx="12" cy="12" r="10" /><line x1="12" x2="12" y1="8" y2="12" /><line x1="12" x2="12.01" y1="16" y2="16" /></symbol>
   <symbol id="i-arrow-left" viewBox="0 0 24 24"><path d="m12 19-7-7 7-7" /><path d="M19 12H5" /></symbol>