docs: code comments point at the moved SSO and matrix sections

nix/host-modules/hive-matrix.nix

@@ -760,7 +760,7 @@ in
     # Activation-time token generation — without this the bind-mount
     # would hand tuwunel an empty file on first boot and break every
     # registration until restart. Idempotent;
-    # docs/2-handbook/swarm/matrix.md::Provisioning flow.
+    # docs/4-implementation/swarm/matrix-provisioning.md::Provisioning flow (appservice).
     # Tell an operator whose homeserver already exists that `serverName` is
     # unpinned, at the one moment they are looking: the rebuild.
     #

nix/host-modules/swarm-authelia.nix

@@ -281,7 +281,7 @@ let
   # One machine client per hive in the roster. The model — why identity is
   # per hive rather than per service, why `audience` is the client id, and
   # why these tokens are signed rather than opaque — is in
-  # `docs/2-handbook/swarm/sso.md`, § Machine clients.
+  # `docs/4-implementation/swarm/sso.md`, § Machine clients.
   #
   # Fed to the option as a DEFINITION in the config block below, rather
   # than appended to the declared list downstream. That is what puts it
@@ -986,7 +986,7 @@ in
       # ⚠️ THIS IS A SECURITY BOUNDARY, not a tidy-up. Do not fold it back
       # into `/`: the friendly error page answers **200**, and
       # `auth_request` reads any 2xx as ACCESS GRANTED. Full consequence
-      # list in `docs/2-handbook/swarm/sso.md`, § Machine callers must fail closed.
+      # list in `docs/4-implementation/swarm/sso.md`, § Machine callers must fail closed.
       #
       # The split is by AUDIENCE, not by path list — including the login
       # page's own XHR. Enumerating individual endpoints would leave the