refactor(layout): consolidate backend codebase into backend/ package and clean root directory

- Moved cmd/, core/, plugins/, pkg/, downstream/, and main.go into backend/ directory
- Batch updated all Go source files to import github.com/Rain-kl/Wavelet/backend/...
- Updated Makefile, scripts/swagger.sh, architecture guards, and platform skills
- Passed all quality gates (100% tests, 0 lint issues, clean build)

backend/pkg/httppool/httppool.go

@@ -0,0 +1,106 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+// Package httppool manages shared, optimized HTTP transports to reuse TCP connections.
+package httppool
+
+import (
+	"context"
+	"crypto/tls"
+	"net"
+	"net/http"
+	"net/url"
+	"sync"
+	"time"
+
+	"go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp"
+)
+
+const (
+	dialTimeout           = 30 * time.Second
+	dialKeepAlive         = 30 * time.Second
+	maxIdleConns          = 200
+	maxIdleConnsPerHost   = 32
+	idleConnTimeout       = 90 * time.Second
+	tlsHandshakeTimeout   = 10 * time.Second
+	expectContinueTimeout = 1 * time.Second
+	tlsSessionCacheSize   = 100
+)
+
+var (
+	defaultTransport http.RoundTripper
+	once             sync.Once
+)
+
+// TransportOptions configures the request-specific parts of a pooled HTTP
+// transport. Pool sizes and timeout defaults remain managed by this package.
+// A nil Proxy explicitly disables proxy use.
+type TransportOptions struct {
+	Proxy                 func(*http.Request) (*url.URL, error)
+	DialContext           func(context.Context, string, string) (net.Conn, error)
+	TLSClientConfig       *tls.Config
+	ResponseHeaderTimeout time.Duration
+	TraceFilter           func(*http.Request) bool
+}
+
+// NewTransport returns an independently configurable pooled transport wrapped
+// with OTel instrumentation. The supplied TLS configuration is cloned before
+// use so later caller mutations cannot change an active transport.
+func NewTransport(options TransportOptions) http.RoundTripper {
+	dialContext := options.DialContext
+	if dialContext == nil {
+		dialContext = (&net.Dialer{
+			Timeout:   dialTimeout,
+			KeepAlive: dialKeepAlive,
+		}).DialContext
+	}
+
+	tlsConfig := options.TLSClientConfig
+	if tlsConfig == nil {
+		tlsConfig = &tls.Config{}
+	} else {
+		tlsConfig = tlsConfig.Clone()
+	}
+	if tlsConfig.ClientSessionCache == nil {
+		tlsConfig.ClientSessionCache = tls.NewLRUClientSessionCache(tlsSessionCacheSize)
+	}
+
+	transport := &http.Transport{
+		Proxy:                 options.Proxy,
+		DialContext:           dialContext,
+		ForceAttemptHTTP2:     true,
+		MaxIdleConns:          maxIdleConns,
+		MaxIdleConnsPerHost:   maxIdleConnsPerHost,
+		IdleConnTimeout:       idleConnTimeout,
+		TLSHandshakeTimeout:   tlsHandshakeTimeout,
+		ResponseHeaderTimeout: options.ResponseHeaderTimeout,
+		ExpectContinueTimeout: expectContinueTimeout,
+		TLSClientConfig:       tlsConfig,
+	}
+	otelOptions := make([]otelhttp.Option, 0, 1)
+	if options.TraceFilter != nil {
+		otelOptions = append(otelOptions, otelhttp.WithFilter(options.TraceFilter))
+	}
+	return otelhttp.NewTransport(transport, otelOptions...)
+}
+
+// DefaultTransport returns a globally shared, optimized http.RoundTripper
+// with OTel instrumentation. It maintains a pool of idle TCP connections
+// across hosts.
+func DefaultTransport() http.RoundTripper {
+	once.Do(func() {
+		defaultTransport = NewTransport(TransportOptions{
+			Proxy: http.ProxyFromEnvironment,
+		})
+	})
+	return defaultTransport
+}
+
+// NewClient returns a new http.Client that shares the global connection pool
+// but has its own timeout configuration.
+func NewClient(timeout time.Duration) *http.Client {
+	return &http.Client{
+		Timeout:   timeout,
+		Transport: DefaultTransport(),
+	}
+}

backend/pkg/httppool/httppool_test.go

@@ -0,0 +1,100 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package httppool
+
+import (
+	"context"
+	"crypto/tls"
+	"io"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+)
+
+func TestDefaultTransport(t *testing.T) {
+	tr1 := DefaultTransport()
+	if tr1 == nil {
+		t.Fatal("DefaultTransport() returned nil")
+	}
+
+	tr2 := DefaultTransport()
+	if tr1 != tr2 {
+		t.Error("DefaultTransport() did not return a singleton instance")
+	}
+}
+
+func TestNewClient(t *testing.T) {
+	timeout := 15 * time.Second
+	client := NewClient(timeout)
+	if client == nil {
+		t.Fatal("NewClient() returned nil")
+	}
+
+	if client.Timeout != timeout {
+		t.Errorf("NewClient() timeout = %v, want %v", client.Timeout, timeout)
+	}
+
+	if client.Transport != DefaultTransport() {
+		t.Error("NewClient() is not configured with the default transport")
+	}
+}
+
+func TestNewTransportUsesConfiguredDirectDialer(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(writer http.ResponseWriter, _ *http.Request) {
+		_, _ = writer.Write([]byte("ok"))
+	}))
+	t.Cleanup(server.Close)
+
+	var dialedAddress string
+	dialer := &net.Dialer{}
+	transport := NewTransport(TransportOptions{
+		Proxy: nil,
+		DialContext: func(ctx context.Context, network string, address string) (net.Conn, error) {
+			dialedAddress = address
+			return dialer.DialContext(ctx, network, server.Listener.Addr().String())
+		},
+	})
+	client := &http.Client{Transport: transport}
+	t.Cleanup(client.CloseIdleConnections)
+
+	request, err := http.NewRequestWithContext(t.Context(), http.MethodGet, "http://artifact.example/site.zip", nil)
+	if err != nil {
+		t.Fatalf("NewRequestWithContext() error = %v", err)
+	}
+	response, err := client.Do(request)
+	if err != nil {
+		t.Fatalf("client.Do() error = %v", err)
+	}
+	defer func() { _ = response.Body.Close() }()
+	if _, err := io.ReadAll(response.Body); err != nil {
+		t.Fatalf("ReadAll() error = %v", err)
+	}
+	if dialedAddress != "artifact.example:80" {
+		t.Fatalf("DialContext address = %q, want direct target", dialedAddress)
+	}
+}
+
+func TestNewTransportClonesTLSConfig(t *testing.T) {
+	server := httptest.NewTLSServer(http.HandlerFunc(func(writer http.ResponseWriter, _ *http.Request) {
+		writer.WriteHeader(http.StatusNoContent)
+	}))
+	t.Cleanup(server.Close)
+
+	tlsConfig := &tls.Config{InsecureSkipVerify: true} //nolint:gosec // test-only self-signed server
+	client := &http.Client{Transport: NewTransport(TransportOptions{TLSClientConfig: tlsConfig})}
+	t.Cleanup(client.CloseIdleConnections)
+	tlsConfig.InsecureSkipVerify = false
+
+	request, err := http.NewRequestWithContext(t.Context(), http.MethodGet, server.URL, nil)
+	if err != nil {
+		t.Fatalf("NewRequestWithContext() error = %v", err)
+	}
+	response, err := client.Do(request)
+	if err != nil {
+		t.Fatalf("client.Do() error = %v", err)
+	}
+	_ = response.Body.Close()
+}