docs: restructure into topic subdirectories, collapse duplicated index

Per mara's go-ahead on hyperhive#3902 ("getting started is good, but
terminal rendering does not go in there i think"):

Moved 21 top-level docs/*.md files into 7 new topic subdirectories
(existing web-ui/, turn-loop/, swarm/, tools/, crates/ untouched):
  getting-started/  setup.md
  agent-lifecycle/  agent-hierarchy.md, approvals.md, persistence.md
  trust-boundary/   boundary.md, security.md
  integrations/     forge.md, matrix.md, github.md, knowledge.md
  networking/       gateway.md, network.md, snapshot-store.md
  scheduler/        jobq.md, coordinator.md, ci.md, observability.md
  process/          conventions.md, gotchas.md, pr-review-gate.md
  web-ui/           terminal-rendering.md (moved into the EXISTING dir,
                    per mara's correction to the original getting-started
                    guess -- it's UI implementation detail, not onboarding)

The physical layout now matches docs/README.md's own topical headers,
which already amounted to this taxonomy -- see the scoping comment on
the issue for the two findings that motivated this (a genuine
duplication between CLAUDE.md's old "Reading paths" list and
docs/README.md's grouped one, since drifted out of sync with each
other; and the flat layout not matching the grouping we already had).

Fixed every cross-reference this moved across the whole repo (~120
files: docs/ internal links at every depth, Rust doc comments, nix
module option docs, crate READMEs) -- verified two ways: a grep sweep
confirming zero remaining references to any old path, and a script
that resolves every markdown link in docs/**/*.md + CLAUDE.md +
README.md against the filesystem and reports anything that doesn't
exist (zero broken links).

Collapsed CLAUDE.md's "Reading paths" section (the duplicate) down to
a pointer at docs/README.md, now the single index. Rewrote
docs/README.md itself to use the new subdirectory paths and added the
one doc it was missing that CLAUDE.md's old copy had (pr-review-gate.md).

Classified all 22 docs/*.md files first via a haiku subagent (mara's
suggestion) on two axes -- proposed grouping and operator-vs-
implementation focus -- before finalizing the taxonomy; spot-checked
the report and found internal inconsistencies (its classification
table disagreed with its own summary section for a few files), so this
taxonomy is my original proposal + the one correction mara gave
directly, not a blind application of the subagent's table. The
operator-focus data it gathered is still useful for a follow-up
content pass (docs skewing 'mixed' rather than pure operator-facing),
not addressed in this PR -- structure only.

nix fmt clean, both pre-push lints clean.

nix/host-modules/hive-c0re/default.nix

@@ -215,7 +215,7 @@ in
     # Operators granted sudoless `hivectl`. Members of `hive-admin` can
     # connect to the host admin socket (group-owned by hive-admin via the
     # socket unit's `SocketGroup` below) without root. That socket is *full*
-    # hive control (spawn/kill/destroy/deploy, docs/boundary.md), so this is
+    # hive control (spawn/kill/destroy/deploy, docs/trust-boundary/boundary.md), so this is
     # an explicit opt-in allowlist — empty by default (root-only).
     users.groups.hive-admin = {
       members = cfg.adminUsers;
@@ -223,7 +223,7 @@ in
 
     # The gateway nginx is always the sole external entry point (it runs
     # alongside hyperhive), so the per-agent web-port range stays closed on
-    # the host firewall. See `docs/gateway.md::Firewall posture (host-level)`.
+    # the host firewall. See `docs/networking/gateway.md::Firewall posture (host-level)`.
 
     # NB: `services.hyperhive.domain` is required when hyperhive is
     # enabled — the canonical assertion lives in `hive-network.nix` (the
@@ -368,7 +368,7 @@ in
         # `0660 root:hive-admin` — group-owned by `hive-admin` so operators in
         # that group (services.hyperhive.c0re.adminUsers) drive `hivectl`
         # without root; an empty adminUsers list leaves the group memberless,
-        # so it stays effectively root-only. See docs/boundary.md.
+        # so it stays effectively root-only. See docs/trust-boundary/boundary.md.
         SocketMode = "0660";
         SocketGroup = "hive-admin";
         # `0751` (traverse-only, no listing) so hive-admin can reach the socket

nix/host-modules/hive-c0re/environment.nix

@@ -57,7 +57,7 @@ in
 // {
   # Identity env vars threaded into c0re's own service env and
   # forwarded by meta.rs into every sub-agent's harness env —
-  # full chain in docs/conventions.md::Hive identity. `domain` is
+  # full chain in docs/process/conventions.md::Hive identity. `domain` is
   # required (asserted in hive-network.nix), so it's always set.
   HYPERHIVE_HIVE_DOMAIN = config.services.hyperhive.domain;
 }
@@ -141,7 +141,7 @@ in
   # hive-c0re (forge/mod.rs `forge_http_base()`) and forwarded to
   # agents via meta.rs for their forge-notify client. The forge is
   # mandatory, so this is unconditional (the whole env block is already
-  # gated on hyperhive being enabled). See `docs/gateway.md::HIVE_FORGE_URL`.
+  # gated on hyperhive being enabled). See `docs/networking/gateway.md::HIVE_FORGE_URL`.
   HIVE_FORGE_URL = "http://${config.services.hyperhive.swarm.forge.domain}";
 
   # The one blacklist of names an agent may not take — see
@@ -197,7 +197,7 @@ in
   # Availability flags read by the dashboard's `/api/state`.
   # Matrix GUI lives entirely on the gateway nginx (matrix tab
   # only shows when both flags are on). Gateway routing detail:
-  # docs/gateway.md::Vhost map.
+  # docs/networking/gateway.md::Vhost map.
   HIVE_MATRIX_GUI_ENABLED = "1";
 }
 // {

nix/host-modules/hive-c0re/options.nix

@@ -427,7 +427,7 @@
         `hivectl` (and thus the whole hive) without `sudo`.
 
         This is a real privilege grant: the admin socket is *full* hive
-        control — spawn / kill / destroy / deploy — see `docs/boundary.md`.
+        control — spawn / kill / destroy / deploy — see `docs/trust-boundary/boundary.md`.
         Keep the list to trusted operators. Empty (the default) keeps the
         socket root-only, as before.
       '';