docs: restructure into topic subdirectories, collapse duplicated index

Per mara's go-ahead on hyperhive#3902 ("getting started is good, but
terminal rendering does not go in there i think"):

Moved 21 top-level docs/*.md files into 7 new topic subdirectories
(existing web-ui/, turn-loop/, swarm/, tools/, crates/ untouched):
  getting-started/  setup.md
  agent-lifecycle/  agent-hierarchy.md, approvals.md, persistence.md
  trust-boundary/   boundary.md, security.md
  integrations/     forge.md, matrix.md, github.md, knowledge.md
  networking/       gateway.md, network.md, snapshot-store.md
  scheduler/        jobq.md, coordinator.md, ci.md, observability.md
  process/          conventions.md, gotchas.md, pr-review-gate.md
  web-ui/           terminal-rendering.md (moved into the EXISTING dir,
                    per mara's correction to the original getting-started
                    guess -- it's UI implementation detail, not onboarding)

The physical layout now matches docs/README.md's own topical headers,
which already amounted to this taxonomy -- see the scoping comment on
the issue for the two findings that motivated this (a genuine
duplication between CLAUDE.md's old "Reading paths" list and
docs/README.md's grouped one, since drifted out of sync with each
other; and the flat layout not matching the grouping we already had).

Fixed every cross-reference this moved across the whole repo (~120
files: docs/ internal links at every depth, Rust doc comments, nix
module option docs, crate READMEs) -- verified two ways: a grep sweep
confirming zero remaining references to any old path, and a script
that resolves every markdown link in docs/**/*.md + CLAUDE.md +
README.md against the filesystem and reports anything that doesn't
exist (zero broken links).

Collapsed CLAUDE.md's "Reading paths" section (the duplicate) down to
a pointer at docs/README.md, now the single index. Rewrote
docs/README.md itself to use the new subdirectory paths and added the
one doc it was missing that CLAUDE.md's old copy had (pr-review-gate.md).

Classified all 22 docs/*.md files first via a haiku subagent (mara's
suggestion) on two axes -- proposed grouping and operator-vs-
implementation focus -- before finalizing the taxonomy; spot-checked
the report and found internal inconsistencies (its classification
table disagreed with its own summary section for a few files), so this
taxonomy is my original proposal + the one correction mara gave
directly, not a blind application of the subagent's table. The
operator-focus data it gathered is still useful for a follow-up
content pass (docs skewing 'mixed' rather than pure operator-facing),
not addressed in this PR -- structure only.

nix fmt clean, both pre-push lints clean.

hive-c0re/src/dashboard/mod.rs

@@ -214,7 +214,7 @@ pub async fn serve(
             webhook_secret,
         });
     // Binds loopback-only; external access via gateway.
-    // Rationale: docs/gateway.md::Firewall posture.
+    // Rationale: docs/networking/gateway.md::Firewall posture.
     let addr = SocketAddr::from(([127, 0, 0, 1], port));
     let listener = bind_with_retry(addr).await?;
     tracing::info!(%addr, "dashboard listening");

hive-c0re/src/dashboard/state_files.rs

@@ -2,7 +2,7 @@
 //!
 //! `GET /api/state-file?path=…` serves an allow-listed file (per-agent
 //! `state/` or `shared/`) with defense-in-depth symlink + traversal checks
-//! (see `docs/security.md::State-file endpoint`); raster images are served
+//! (see `docs/trust-boundary/security.md::State-file endpoint`); raster images are served
 //! with their real content-type, everything else as truncated text.
 //! `scan_validated_paths` runs the same allow-list at broker-message ingest
 //! so dashboard events carry a pre-verified file-ref set.
@@ -19,7 +19,7 @@ use crate::paths::{AGENTS_ROOT, SHARED_ROOT};
 #[derive(Deserialize, IntoParams)]
 pub(super) struct StateFileQuery {
     /// Absolute path under an agent's `state/` dir or under `shared/`;
-    /// checked against the allow-list (`docs/security.md::State-file
+    /// checked against the allow-list (`docs/trust-boundary/security.md::State-file
     /// endpoint`).
     path: String,
 }
@@ -27,7 +27,7 @@ pub(super) struct StateFileQuery {
 /// Resolve a caller-supplied path against the allow-listed roots
 /// (`agents/<n>/state/` and `shared/`). Applies defense-in-depth
 /// symlink + traversal checks before serving. Security model and
-/// all five layers: `docs/security.md::State-file endpoint`.
+/// all five layers: `docs/trust-boundary/security.md::State-file endpoint`.
 fn resolve_state_path(
     raw: &str,
 ) -> std::result::Result<(std::path::PathBuf, std::fs::Metadata), String> {

hive-c0re/src/dashboard/state_snapshot.rs

@@ -89,7 +89,7 @@ pub(super) struct StateSnapshot {
     /// runtime-generated `agents.conf` include file — see
     /// `gateway_nginx.rs`). The `false` branch (direct
     /// `http://<hostname>:<port>/` TCP links) is retained as a defensive
-    /// fallback for the env being unset. See `docs/gateway.md::Vhost map`.
+    /// fallback for the env being unset. See `docs/networking/gateway.md::Vhost map`.
     gateway_enabled: bool,
     /// Public URL of the forge (e.g.
     /// `"https://forge.pr1ma.darkest.space"`). Sourced from the