docs: sort the top-level directories into five sections by what the reader wants

Every docs directory moves under 1-getting-started, 2-handbook,
4-implementation or 5-project; the options reference (section 3) comes from
the website and has no directory here. trust-boundary stays whole under the
handbook for now. web-ui, swarm and tools split between handbook and
implementation, and the command-line references move to
2-handbook/reference. Links, path references in code and nix, and the docs
index follow the moves; no page content changes.

nix/module-eval/agent-forge-bao.nix

@@ -210,7 +210,7 @@ let
     }
     {
       # tea-login copied the token into ~/.config/tea/config.yml, which
-      # docs/swarm/credentials.md forbids for a store secret. Gone, with the
+      # docs/2-handbook/swarm/credentials.md forbids for a store secret. Gone, with the
       # package it configured.
       name = "no tea-login unit and no tea package";
       ok =

nix/module-eval/bao-grants.nix

@@ -143,7 +143,7 @@ let
 
   # Two credentials write grants, and each is checked against what the units
   # holding it actually call. The bootstrap token's policy is read from the
-  # file the operator writes it from (../../docs/getting-started/setup.md
+  # file the operator writes it from (../../docs/1-getting-started/setup.md
   # points there); the granter's from the unit that writes it. Units are found
   # by the credential they read rather than by name, so a new one is checked
   # without anyone listing it here.
@@ -2506,7 +2506,7 @@ let
       name = "setup.md's reset-failed and restart after the one-time step reach every granting unit";
       ok =
         let
-          lines = lib.splitString "\n" (builtins.readFile ../../docs/getting-started/setup.md);
+          lines = lib.splitString "\n" (builtins.readFile ../../docs/1-getting-started/setup.md);
           # The unit patterns on the one `systemctl <verb> 'swarm-bao-…` line.
           argsOf =
             verb:

nix/module-eval/swarm-otel-core.nix

@@ -25,7 +25,7 @@ let
     ;
 
   # A swarm collector on a host that runs NEITHER store — the fully-spread
-  # shape from docs/swarm/services.md, and the one the old per-host gates made
+  # shape from docs/2-handbook/swarm/services.md, and the one the old per-host gates made
   # inexpressible. It is the whole point of the cases below that this hive is
   # not a degenerate configuration but a supported one.
   mkOtelNoStores =

nix/module-eval/swarm-services-switch.nix

@@ -26,7 +26,7 @@ let
     ;
 
   # A dedicated services host with hives elsewhere: the swarm-services
-  # toggle and no hive, the recipe docs/swarm/services.md gives.
+  # toggle and no hive, the recipe docs/2-handbook/swarm/services.md gives.
   swarmServicesOnly = shared.servicesHere;
 
   # A services host with hives elsewhere and the store elsewhere too: no hive