Group the module crates under modules/

The service pseudo-clients and the ircd protocol link sat flat at the
repo root, mixed in with the daemon core and the SDK. Move them all
under modules/ so the tree separates concerns cleanly: the daemon in
src/, the SDK every module links against in api/, and the loadable
modules — the pseudo-clients plus the protocol link — in modules/.

Workspace members, the daemon's per-crate dependency paths, and each
module's api path are updated to match; the docs follow. No code change.

modules/hostserv/src/approve.rs

@@ -0,0 +1,46 @@
+use fedserv_api::{NetView, Sender, ServiceCtx, Store};
+
+// ACTIVATE <account> / REJECT <account>: approve a pending vhost request (setting
+// and applying it) or turn it down. Operators only.
+pub fn handle(me: &str, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, net: &dyn NetView, db: &mut dyn Store, activate: bool) {
+    if !super::require_oper(me, from, ctx) {
+        return;
+    }
+    let Some(&account) = args.get(1) else {
+        let syntax = if activate { "Syntax: ACTIVATE <account>" } else { "Syntax: REJECT <account>" };
+        ctx.notice(me, from.uid, syntax);
+        return;
+    };
+    let host = match db.take_vhost_request(account) {
+        Ok(Some(h)) => h,
+        Ok(None) => {
+            ctx.notice(me, from.uid, format!("\x02{account}\x02 has no pending vhost request."));
+            return;
+        }
+        Err(_) => {
+            ctx.notice(me, from.uid, format!("\x02{account}\x02 isn't registered."));
+            return;
+        }
+    };
+    if !activate {
+        ctx.notice(me, from.uid, format!("Rejected \x02{account}\x02's vhost request."));
+        return;
+    }
+    // Re-check the requested host now (another account may have taken it since).
+    let host = match super::prepare_vhost(&host, account, db) {
+        Ok(h) => h,
+        Err(msg) => {
+            ctx.notice(me, from.uid, format!("Can't activate: {msg}"));
+            return;
+        }
+    };
+    match db.set_vhost(account, &host, from.nick, None) {
+        Ok(()) => {
+            for uid in net.uids_logged_into(account) {
+                ctx.apply_vhost(&uid, &host);
+            }
+            ctx.notice(me, from.uid, format!("Activated vhost \x02{host}\x02 for \x02{account}\x02."));
+        }
+        Err(_) => ctx.notice(me, from.uid, "Sorry, that didn't work. Please try again in a moment."),
+    }
+}