Re-organize the source tree as a monorepo mirroring the FHS

The source layout now mirrors the runtime filesystem hierarchy
(docs/danos-file-system-hierarchy-FSH.md): what lives under system/ in the
source is what a running danos represents under /system. Each service and
driver is a sub-project directory that is its own Zig module — cross-project
references go by module name, never by a path into another project's files.

Moves (all git mv, history preserved):
- src/            -> system/            (danos internals; the self-representation)
    root.zig      -> danos.zig          (the kernel<->user contract module)
    kernel/arch/  -> kernel/architecture/   (arch -> architecture)
    device/       -> devices/           (what /system/devices reflects)
    boot/         -> /boot              (the loaders, top level)
- sbin/           -> split by role:
    init, vfs     -> system/services/<name>/<name>.zig
    hpetd, busd   -> system/drivers/<name>/<name>.zig
    vfs-test      -> system/services/vfs/vfs-test.zig  (inside the vfs project)
- lib/            -> library/runtime/   (room for other libraries beside runtime)

The VFS wire protocol becomes its own module, system/services/vfs/protocol.zig
("vfs-protocol"): the vfs sub-project exposes its interface, and the runtime's
file layer imports it by name. First instance of the "protocol module" pattern
(docs/driver-model.md); usb/block will expose theirs the same way.

Also: fix a naming-standard violation in the protocol — Op -> Operation (and
req -> request, _pad -> _padding). Docs updated: /system/services added to the
FHS doc, a repository-layout section added to the docs index, and stale source
paths swept across comments and docs.

Runtime boot paths are unchanged (the bootloader still loads /sbin/init);
aligning the runtime filesystem to the FHS is a separate follow-up. Suite 35/35
plus host tests green.

system/devices/power.zig

@@ -0,0 +1,104 @@
+//! Machine power control: enter ACPI mode, reboot, and power off (ACPI S5).
+//!
+//! Built entirely on the register map `acpi` extracted from the FADT plus the
+//! sleep-state (`_Sx`) types the AML submodule pulled from the DSDT, driven through the
+//! injected `Hal` (port I/O and MMIO). Nothing here is x86-specific beyond the
+//! well-known legacy reset fallbacks, which are guarded behind the ACPI methods.
+//!
+//! S3 (suspend-to-RAM) is stubbed: it needs a wake trampoline and device
+//! re-initialisation, a milestone of its own.
+
+const acpi = @import("acpi.zig");
+const device_model = @import("device-model.zig");
+const Hal = device_model.Hal;
+
+const slp_en: u32 = 1 << 13; // SLP_EN: writing 1 triggers the sleep transition
+const sci_en: u32 = 1 << 0; // SCI_EN in PM1 control: set once ACPI mode is active
+
+/// Switch the platform into ACPI mode if it isn't already, so the PM1 control
+/// register is live. A no-op when the firmware exposes no SMI command port (ACPI
+/// already enabled, as under QEMU/OVMF) — we still verify SCI_EN first.
+pub fn enable(hal: Hal) void {
+    const pi = acpi.power_information;
+    if (!pi.pm1a_cnt.present()) return;
+    if (readRegister(hal, pi.pm1a_cnt) & sci_en != 0) return; // already in ACPI mode
+    if (pi.smi_cmd == 0 or pi.acpi_enable == 0) return; // no way to switch; assume fine
+
+    hal.pioWrite(1, pi.smi_cmd, pi.acpi_enable);
+    var spins: usize = 0;
+    while (readRegister(hal, pi.pm1a_cnt) & sci_en == 0 and spins < 1_000_000) : (spins += 1) {}
+}
+
+/// Restart the machine. Tries the ACPI reset register first, then the two legacy
+/// fallbacks. Returns only if every method failed (very unlikely).
+pub fn reboot(hal: Hal) void {
+    const pi = acpi.power_information;
+
+    // 1. The FADT reset register, when the firmware advertises support.
+    if (pi.reset_supported and pi.reset.present()) {
+        writeRegister(hal, pi.reset, pi.reset_value);
+        delay();
+    }
+    // 2. The PCI reset-control register at port 0xCF9 (RST_CPU | SYSTEM_RST).
+    hal.pioWrite(1, 0xCF9, 0x0E);
+    hal.pioWrite(1, 0xCF9, 0x06);
+    delay();
+    // 3. Pulse the 8042 keyboard controller's reset line.
+    hal.pioWrite(1, 0x64, 0xFE);
+    delay();
+}
+
+/// Power the machine off via ACPI S5. Requires the soft-off (`_S5`) sleep type; if
+/// it wasn't found in the AML, there is nothing safe to do and this returns.
+pub fn shutdown(hal: Hal) void {
+    enable(hal);
+    const pi = acpi.power_information;
+    const s5 = pi.s5 orelse return;
+
+    if (pi.pm1a_cnt.present()) {
+        writeRegister(hal, pi.pm1a_cnt, sleepValue(s5.slp_typ_a));
+    }
+    if (pi.pm1b_cnt.present()) {
+        writeRegister(hal, pi.pm1b_cnt, sleepValue(s5.slp_typ_b));
+    }
+    delay();
+}
+
+/// S3 suspend-to-RAM — not implemented (needs a wake path + device re-init).
+pub fn sleepS3(hal: Hal) error{Unsupported}!void {
+    _ = hal;
+    return error.Unsupported;
+}
+
+/// The PM1 control write that requests sleep type `slp_typ`: SLP_TYP in bits
+/// [12:10], SLP_EN in bit 13.
+fn sleepValue(slp_typ: u8) u32 {
+    return (@as(u32, slp_typ & 0x7) << 10) | slp_en;
+}
+
+fn readRegister(hal: Hal, register: acpi.RegisterAccess) u32 {
+    if (register.mmio) {
+        const p: *align(1) volatile u32 = @ptrFromInt(hal.mapMmio(register.address, 4, true));
+        return p.*;
+    }
+    return hal.pioRead(register.width, @intCast(register.address));
+}
+
+fn writeRegister(hal: Hal, register: acpi.RegisterAccess, value: u32) void {
+    if (register.mmio) {
+        const p: *align(1) volatile u32 = @ptrFromInt(hal.mapMmio(register.address, 4, true));
+        p.* = value;
+    } else {
+        hal.pioWrite(register.width, @intCast(register.address), value);
+    }
+}
+
+/// A short busy-wait so a reset/power-off takes effect before we fall through to
+/// the next method. The empty asm is an architecture-neutral barrier that keeps the loop
+/// from being optimised away.
+fn delay() void {
+    var i: usize = 0;
+    while (i < 50_000_000) : (i += 1) {
+        asm volatile ("" ::: .{ .memory = true });
+    }
+}