refactor: restructure config files

AGENTS.md

@@ -31,7 +31,9 @@ In this repo, `flake.nix` imports `./modules` recursively via `inputs.import-tre
 
 ## Repo Structure
 
-- `modules/features/`: reusable features and most aspect definitions.
+- `modules/capabilities/`: reusable leaf capability features and most aspect definitions.
+- `modules/capabilities/services/`: reusable service capabilities, especially hosted daemons and network services.
+- `modules/profiles/`: bundle features that assemble capabilities into larger profiles such as `host-base` and `workstation-base`.
 - `modules/hosts/<name>/default.nix`: host features that assemble NixOS aspects into `flake.modules.nixos.<name>`.
 - `modules/secrets/`: secret-related features shared by hosts.
 - `modules/flake-parts.nix`: flake-parts entrypoint; defines systems, formatter, and `flake.nixosConfigurations`.
@@ -60,7 +62,9 @@ Use **Collector Aspect** only when composition through imports or shared library
 
 ## Change Rules
 
-- When adding a feature, add or extend aspects under `modules/features/` and let hosts opt into them explicitly.
+- When adding a reusable leaf feature, add or extend aspects under `modules/capabilities/` and let profiles or hosts opt into them explicitly.
+- When adding a hosted service or network daemon feature, prefer `modules/capabilities/services/`.
+- When adding a bundle of existing capabilities, put it under `modules/profiles/`.
 - When adding a host, create `modules/hosts/<name>/default.nix` and keep host-local generated files private as `_hardware.nix`, `_disk.nix`, or similar.
 - When a feature needs local data or helper code, keep it inside that feature directory and prefix non-feature files with `_` when they live under `modules/`.
 - Do not place arbitrary non-feature `.nix` files under `modules/` unless they are intentionally private and excluded from recursive import.