docs: the handbook follows the three layers: swarm, hives, agents

The handbook's sections were agent-lifecycle, integrations, swarm, tools,
trust-boundary and web-ui, which do not follow how the system is built, so a
reader could not tell which layer a page is about. Its pages now sit in
swarm/, hives/ and agents/, with the accounts an agent can hold outside the
system in external-accounts/.

- swarm/: forge, matrix and the knowledge repo join the swarm pages, and so
  does the swarmctl reference.
- hives/: the dashboard, hivectl and its reference, and the operator/agent
  boundary, with a README that takes over the old web-ui and tools pages.
- agents/: the roster, persistence, config changes, the agent's own web page
  (was web-ui/agent) and the security model, with a README.
- external-accounts/: GitHub and GitLab.

Pages are moved whole; none is split yet. Every reference follows: relative
links in the docs, `docs/2-handbook/...` paths in code comments, the nix
checks that regenerate the CLI references and the ignore list, and docs/README.md,
whose handbook section is now by layer.

hive-c0re/README.md

@@ -12,7 +12,7 @@ Host-level, cross-container orchestration: spawning/rebuilding/
 destroying agent containers, dashboard-visible
 state, wiring each agent's gateway vhost and reconciling its forge
 config-repo access and matrix room membership. The accounts themselves
-are swarm-controller's (`docs/2-handbook/integrations/forge.md`). Agent-side
+are swarm-controller's (`docs/2-handbook/swarm/forge.md`). Agent-side
 behavior (turn loop, MCP tools) lives in `hive-agent`/`hive-agent-mcp`
 instead — this daemon only talks to agents over the socket wire types
 in `hive-sh4re`.
@@ -39,7 +39,7 @@ to track it:
 - **`stats/`** — dashboard metrics aggregation + OTEL export.
 - **`socket_server/`** — the unix-socket request server for the
   per-agent sockets.
-- **`forge/`** — optional Forgejo wiring (`docs/2-handbook/integrations/forge.md`).
+- **`forge/`** — optional Forgejo wiring (`docs/2-handbook/swarm/forge.md`).
 - **`coordinator.rs`** — top-level wiring for `serve`.
 - **`agent_set.rs`** — the files that
   follow the agent set (topology, gateway map). **`meta.rs`** — the commit

hive-c0re/src/forge/mod.rs

@@ -2,7 +2,7 @@
 //! every hive. The
 //! swarm-wide orgs, teams and repos, and each agent's read grant on
 //! `internal/docs`, are swarm-controller's. Full design:
-//! `docs/2-handbook/integrations/forge.md`.
+//! `docs/2-handbook/swarm/forge.md`.
 
 mod reader;
 

hive-c0re/src/lifecycle/host_config.rs

@@ -289,7 +289,7 @@ async fn systemd_daemon_reload() -> Result<()> {
 }
 
 /// Append the bind flag for `child`'s `state` dir into `binds`. See
-/// docs/2-handbook/agent-lifecycle/persistence.md ("Cross-agent access to state") for what
+/// docs/2-handbook/agents/persistence.md ("Cross-agent access to state") for what
 /// the holder may touch and why. Creates the missing host-side directory so
 /// nspawn doesn't refuse to start; a missing dir is non-fatal.
 ///

hive-c0re/src/migrate.rs

@@ -17,7 +17,7 @@
 //!   `agent-permissions` bucket when the swarm UI creates her.
 //!
 //! Kill-switch: `HIVE_SKIP_META_MIGRATION=1`. Full sequence and phase
-//! details: `docs/2-handbook/agent-lifecycle/config-changes.md::Startup migrations (older hosts)`.
+//! details: `docs/2-handbook/agents/config-changes.md::Startup migrations (older hosts)`.
 
 use std::path::Path;
 use std::time::Duration;

hive-c0re/src/stores/build_logs.rs

@@ -1,7 +1,7 @@
 //! Sqlite-backed full build-log capture — stdout + stderr per
 //! `nixos-container` / `nix build` invocation, accumulated live.
 //! Schema, indices, retention, and the rationale for replacing
-//! the old ring buffer: `docs/2-handbook/agent-lifecycle/persistence.md::/var/lib/hyperhive/db/build_logs.sqlite`.
+//! the old ring buffer: `docs/2-handbook/agents/persistence.md::/var/lib/hyperhive/db/build_logs.sqlite`.
 
 use std::path::Path;
 use std::sync::{Arc, Mutex, OnceLock};

hive-c0re/src/workers/crash_watch.rs

@@ -4,7 +4,7 @@
 //! that line directly; see the module doc on [`emit_crash_transitions`].
 //! Login-state transitions (`needs_login`/`logged_in`) publish onto
 //! `swarm_notices` instead. The `RECENT_TRANSIENT_GRACE` window:
-//! `docs/2-handbook/agent-lifecycle/config-changes.md::System messages`.
+//! `docs/2-handbook/agents/config-changes.md::System messages`.
 
 use std::collections::HashSet;
 use std::sync::Arc;