[dormancygrace]

The IPMI add-on was split across server/cmd, server/internal and firmware/alpine/packages, while RustDesk already lived under addons/.

Move the IPMI daemon, protocol implementation/tests, recipe and lifecycle scripts into addons/ipmi/ as a separate Go module. Expose the existing shared BMC package as server/pkg/bmc so IPMI and the server's Redfish implementation continue using one copy. The add-on references that package through a local module replacement at the same checkout revision.

Update the APK builder, release workflow paths, Go CI matrix, Dependabot and developer documentation. Package name/version, minimum OS dependency, installed paths, configuration and lifecycle scripts remain unchanged. Protocol and shared BMC implementation files are byte-for-byte moves.

Validation:

• Full server build, tests and vet with teststub,nomsgpack.
• IPMI tests with the race detector and vet; shared BMC/Redfish/BMC service/VM tests with the race detector.
• All add-on Python suites, including a native apk-tools upgrade test.
• Built the real static RISC-V APK using the prepared NanoKVM Go runtime and apk-tools 3; checked package version, OS dependency, binary architecture and installed init script.

No device deployment or package publication. Please keep this PR unmerged for review.

[github-actions]

Build outputs

Compared with the build of main at 182a9df; main is at 14fde0e, so outputs changed since then are listed too.

2 changed, 180 added, 180 removed of 570 outputs.

	directory	files
changed	server	server/NanoKVM-Server
changed	web	web/index.html
added	web	180 files
removed	web	180 files
Hashes: outputs-sha256 artifact of this run.

[dormancygrace]

The move is clean.

• The add-on module builds for riscv64 and passes go vet and go test.
• go mod tidy -diff is clean, and no old import path remains.
• The add-on Python tests pass.
• go.package resolves now that build_go runs in the recipe directory.

One coverage gap and a stale doc:

• firmware/alpine/packages/README.md (around lines 161–164, not in this diff) still says the IPMI recipe lives there and is a Go program of server/.

[dormancygrace]

Reviewed the module split, import changes, shared BMC API placement and package build paths. The protocol/crypto and service files retain their previous implementation. Fixed the lost IPMI CodeQL build coverage and added explicit vet/race steps for the new module; updated the stale package documentation. Add-on build/recipe tests, IPMI build/vet/race, server BMC/Redfish/service race tests and the CodeQL server build all pass. Leaving this PR open because restoring security analysis coverage is a substantive correction.

[dormancygrace]

Rechecked the IPMI module/package relocation and restored analysis coverage on current main. Resolved the Dependabot configuration conflict by retaining both the pinned Gorilla exclusion and the local BMC module exclusion. Real add-on build tests, IPMI race/vet, shared BMC/Redfish/service race tests and both CodeQL Go build commands pass. Final-head CI passes; the Publish release job is intentionally skipped for pull requests and was not invoked. No behavior defect found in the moved implementation.