docs: the handbook follows the three layers: swarm, hives, agents

The handbook's sections were agent-lifecycle, integrations, swarm, tools,
trust-boundary and web-ui, which do not follow how the system is built, so a
reader could not tell which layer a page is about. Its pages now sit in
swarm/, hives/ and agents/, with the accounts an agent can hold outside the
system in external-accounts/.

- swarm/: forge, matrix and the knowledge repo join the swarm pages, and so
  does the swarmctl reference.
- hives/: the dashboard, hivectl and its reference, and the operator/agent
  boundary, with a README that takes over the old web-ui and tools pages.
- agents/: the roster, persistence, config changes, the agent's own web page
  (was web-ui/agent) and the security model, with a README.
- external-accounts/: GitHub and GitLab.

Pages are moved whole; none is split yet. Every reference follows: relative
links in the docs, `docs/2-handbook/...` paths in code comments, the nix
checks that regenerate the CLI references and the ignore list, and docs/README.md,
whose handbook section is now by layer.

AGENTS.md

@@ -10,12 +10,12 @@ when you need depth on a subsystem. This file is the index.
   the env var — inside an agent container `localhost` is the *agent*, not
   the forge, so a hardcoded loopback address fails to connect.
 - Operator/agent trust-boundary design:
-  **[docs/2-handbook/trust-boundary/boundary.md](docs/2-handbook/trust-boundary/boundary.md)** (`area/ops` issues
+  **[docs/2-handbook/hives/boundary.md](docs/2-handbook/hives/boundary.md)** (`area/ops` issues
   for the deployment/gateway/privsep work — the separator is a **slash**,
   and `--label area:ops` now fails with `did you mean "area/ops"?`).
 - Agent trust model (trust boundary, prompt-injection threat model,
   capability = accepted risk), credential isolation + sandbox threat model:
-  **[docs/2-handbook/trust-boundary/security.md](docs/2-handbook/trust-boundary/security.md)**.
+  **[docs/2-handbook/agents/security.md](docs/2-handbook/agents/security.md)**.
 - Odd-looking nspawn / container plumbing usually has a story:
   **[docs/5-project/process/gotchas.md](docs/5-project/process/gotchas.md)**.
 
@@ -33,8 +33,8 @@ nix fmt        # treefmt is the CI gate, NOT bare cargo fmt
 
 Changed a `hivectl` / `swarmctl` verb or flag? Regenerate its doc — only
 CI's `nix flake check` catches the drift:
-`nix develop -c cargo run --bin hivectl -- markdown-docs > docs/2-handbook/tools/hivectl-cli.md`
-(same for `swarmctl` → `docs/2-handbook/tools/swarmctl-cli.md`). CI red but local
+`nix develop -c cargo run --bin hivectl -- markdown-docs > docs/2-handbook/hives/hivectl-cli.md`
+(same for `swarmctl` → `docs/2-handbook/swarm/swarmctl-cli.md`). CI red but local
 green → build the suspect check (e.g. `nix build
 .#checks.x86_64-linux.hivectl-docs`) before blaming the builder.
 
@@ -58,10 +58,10 @@ Per-hive (host + in-container):
   crate.
 - **`hivectl/`** — operator CLI; talks to `hive-c0re` over the host admin
   socket, does NOT link it. Verb reference (CI-enforced):
-  [`docs/2-handbook/tools/hivectl-cli.md`](docs/2-handbook/tools/hivectl-cli.md).
+  [`docs/2-handbook/hives/hivectl-cli.md`](docs/2-handbook/hives/hivectl-cli.md).
 - **`hive-priv/`** — minimal root helper, socket-activated at
   `/run/hive/priv.sock`; the few root ops (bind-mount edits, nsenter)
-  `hive-c0re` delegates. See `docs/2-handbook/trust-boundary/boundary.md`.
+  `hive-c0re` delegates. See `docs/2-handbook/hives/boundary.md`.
 - **`hive-agent/`** — the in-container serve loop: turn-loop *policy*
   (`turn.rs`) over `hive-runtime`, per-agent web UI, event + turn-stats
   sinks, system-prompt renderer, claude launch config (`mcp_config.rs`).
@@ -130,7 +130,7 @@ Swarm-level:
   **`users.yml` in place**, shared with `swarm-authelia-bridge`; that
   crate's README says what both writers must uphold. Verb reference
   (CI-enforced):
-  [`docs/2-handbook/tools/swarmctl-cli.md`](docs/2-handbook/tools/swarmctl-cli.md).
+  [`docs/2-handbook/swarm/swarmctl-cli.md`](docs/2-handbook/swarm/swarmctl-cli.md).
 - **`swarm-authelia-bridge/`** (+ **`swarm-authelia-bridge-sock/`** wire
   types) — the other writer of authelia's users DB; runs inside
   `swarm-authelia`.
@@ -225,7 +225,7 @@ in this file and drifted.
 - **Operator-facing doc with real implementation detail mixed in**: wrap
   the implementation part in a `<details><summary>…</summary>` block
   (blank line after `<summary>` so the markdown inside renders) rather
-  than a sibling page — see `docs/2-handbook/integrations/github.md`'s
+  than a sibling page — see `docs/2-handbook/external-accounts/github.md`'s
   "Implementation" section. It only collapses in a rendered browser, and
   the `<summary>` line isn't markdown-processed, so keep it plain prose
   with no backticks.