docs: sort the top-level directories into five sections by what the reader wants

Every docs directory moves under 1-getting-started, 2-handbook,
4-implementation or 5-project; the options reference (section 3) comes from
the website and has no directory here. trust-boundary stays whole under the
handbook for now. web-ui, swarm and tools split between handbook and
implementation, and the command-line references move to
2-handbook/reference. Links, path references in code and nix, and the docs
index follow the moves; no page content changes.

hive-priv/src/container_config.rs

@@ -511,7 +511,7 @@ fn write_nspawn_flags(
     // marker carries the gateway IP so the container need not re-derive it.
     // Always written — every container is isolated, so there is no mode in
     // which the marker should be absent. Why the rewrite is needed at all,
-    // and which unit does it: `docs/networking/network.md` § *How the isolated
+    // and which unit does it: `docs/4-implementation/networking/network.md` § *How the isolated
     // container gets its resolver*.
     write_bridge_dns_marker(container, isolation)?;
     // Read by the agent's environment generator at boot

hive-priv/src/main.rs

@@ -109,7 +109,7 @@ fn check_socket_activation(
 fn socket_listener() -> Result<UnixListener> {
     // hive-priv is ALWAYS socket-activated by the `hive-priv.socket` unit
     // (fd 3 via LISTEN_FDS). There is intentionally no self-bind fallback,
-    // so dev and prod take the same path; see docs/trust-boundary/boundary.md.
+    // so dev and prod take the same path; see docs/2-handbook/trust-boundary/boundary.md.
     check_socket_activation(
         std::env::var("LISTEN_FDS").ok().as_deref(),
         std::env::var("LISTEN_PID").ok().as_deref(),