docs: sort the top-level directories into five sections by what the reader wants

Every docs directory moves under 1-getting-started, 2-handbook,
4-implementation or 5-project; the options reference (section 3) comes from
the website and has no directory here. trust-boundary stays whole under the
handbook for now. web-ui, swarm and tools split between handbook and
implementation, and the command-line references move to
2-handbook/reference. Links, path references in code and nix, and the docs
index follow the moves; no page content changes.

hivectl/src/choom.rs

@@ -79,7 +79,7 @@ fn require_privilege() -> Result<()> {
 /// Execs `machinectl shell <name>@h-<name>` running claude as the agent
 /// user from its state dir, reproducing the harness's per-turn claude
 /// invocation (flags, session selection, why it never collides with the
-/// live harness session). See `docs/tools/hivectl.md` (Choom) for the
+/// live harness session). See `docs/2-handbook/tools/hivectl.md` (Choom) for the
 /// full rationale. Inherits the caller's PTY; requires root or `hive-admin`
 /// group membership, plus a running container.
 ///

hivectl/src/watch.rs

@@ -90,7 +90,7 @@ pub(crate) async fn watch(socket: &Path, name: &str) -> Result<()> {
 
 /// Render one SSE frame (everything up to the blank-line separator,
 /// already stripped) as a single compact terminal line. Not an attempt at
-/// the web UI's full row taxonomy (`docs/web-ui/terminal-rendering.md`) — that's
+/// the web UI's full row taxonomy (`docs/4-implementation/web-ui/terminal-rendering.md`) — that's
 /// presentation for a browser, not a `tail -f`. Falls back to the raw
 /// payload for anything unrecognised rather than silently dropping it, so
 /// a shape this doesn't know about is still visible.