Re-organize the source tree as a monorepo mirroring the FHS

The source layout now mirrors the runtime filesystem hierarchy
(docs/danos-file-system-hierarchy-FSH.md): what lives under system/ in the
source is what a running danos represents under /system. Each service and
driver is a sub-project directory that is its own Zig module — cross-project
references go by module name, never by a path into another project's files.

Moves (all git mv, history preserved):
- src/            -> system/            (danos internals; the self-representation)
    root.zig      -> danos.zig          (the kernel<->user contract module)
    kernel/arch/  -> kernel/architecture/   (arch -> architecture)
    device/       -> devices/           (what /system/devices reflects)
    boot/         -> /boot              (the loaders, top level)
- sbin/           -> split by role:
    init, vfs     -> system/services/<name>/<name>.zig
    hpetd, busd   -> system/drivers/<name>/<name>.zig
    vfs-test      -> system/services/vfs/vfs-test.zig  (inside the vfs project)
- lib/            -> library/runtime/   (room for other libraries beside runtime)

The VFS wire protocol becomes its own module, system/services/vfs/protocol.zig
("vfs-protocol"): the vfs sub-project exposes its interface, and the runtime's
file layer imports it by name. First instance of the "protocol module" pattern
(docs/driver-model.md); usb/block will expose theirs the same way.

Also: fix a naming-standard violation in the protocol — Op -> Operation (and
req -> request, _pad -> _padding). Docs updated: /system/services added to the
FHS doc, a repository-layout section added to the docs index, and stale source
paths swept across comments and docs.

Runtime boot paths are unchanged (the bootloader still loads /sbin/init);
aligning the runtime filesystem to the FHS is a separate follow-up. Suite 35/35
plus host tests green.

docs/acpi.md

@@ -16,13 +16,13 @@ the RSDT's address is a field *inside* the RSDP. The platform follows that point
 UEFI configuration table
    │  the loader reads the RSDP's physical address
    ▼
-BootInfo.acpi_rsdp   (u64, in the shared `danos` module)         src/root.zig
+BootInfo.acpi_rsdp   (u64, in the shared `danos` module)         system/danos.zig
    │  the kernel forwards the whole BootInfo
    ▼
-platform.discover(boot_info, …)                                  src/device/platform.zig
+platform.discover(boot_info, …)                                  system/devices/platform.zig
    │  reads boot_info.acpi_rsdp, hands it to the ACPI backend
    ▼
-acpi.discover(rsdp_phys, …)                                      src/device/acpi.zig
+acpi.discover(rsdp_phys, …)                                      system/devices/acpi.zig
    │  dereferences the RSDP, reads the pointer it contains
    ▼
 RSDP ──(a field in the struct)──► RSDT / XSDT ──► SDTs (MADT, MCFG, FADT, HPET, DSDT…)
@@ -35,7 +35,7 @@ successor the **XSDT** (ACPI 2.0+) — which in turn lists every other SDT.
 ## Step 1 — the loader finds the RSDP
 
 Only the firmware knows where ACPI lives, so the RSDP must be grabbed while UEFI is
-still up. `acpiRootSystemDescriptorPointer()` in `src/boot/efi.zig` walks the UEFI
+still up. `acpiRootSystemDescriptorPointer()` in `boot/efi.zig` walks the UEFI
 **configuration table** for the ACPI GUID and returns the vendor pointer — the same
 "grab it before `ExitBootServices`" pattern as the [framebuffer](framebuffer.md) and
 the [memory map](memory-map.md).
@@ -48,7 +48,7 @@ module at all** (it imports only the shared `danos` module). So instead of a cal
 deposits a value in the handoff struct:
 
 ```zig
-// src/boot/efi.zig — while boot services are still up
+// boot/efi.zig — while boot services are still up
 .acpi_rsdp = if (acpiRootSystemDescriptorPointer()) |p| @intFromPtr(p) else 0,
 ```