docs: restructure into topic subdirectories, collapse duplicated index

Per mara's go-ahead on hyperhive#3902 ("getting started is good, but
terminal rendering does not go in there i think"):

Moved 21 top-level docs/*.md files into 7 new topic subdirectories
(existing web-ui/, turn-loop/, swarm/, tools/, crates/ untouched):
  getting-started/  setup.md
  agent-lifecycle/  agent-hierarchy.md, approvals.md, persistence.md
  trust-boundary/   boundary.md, security.md
  integrations/     forge.md, matrix.md, github.md, knowledge.md
  networking/       gateway.md, network.md, snapshot-store.md
  scheduler/        jobq.md, coordinator.md, ci.md, observability.md
  process/          conventions.md, gotchas.md, pr-review-gate.md
  web-ui/           terminal-rendering.md (moved into the EXISTING dir,
                    per mara's correction to the original getting-started
                    guess -- it's UI implementation detail, not onboarding)

The physical layout now matches docs/README.md's own topical headers,
which already amounted to this taxonomy -- see the scoping comment on
the issue for the two findings that motivated this (a genuine
duplication between CLAUDE.md's old "Reading paths" list and
docs/README.md's grouped one, since drifted out of sync with each
other; and the flat layout not matching the grouping we already had).

Fixed every cross-reference this moved across the whole repo (~120
files: docs/ internal links at every depth, Rust doc comments, nix
module option docs, crate READMEs) -- verified two ways: a grep sweep
confirming zero remaining references to any old path, and a script
that resolves every markdown link in docs/**/*.md + CLAUDE.md +
README.md against the filesystem and reports anything that doesn't
exist (zero broken links).

Collapsed CLAUDE.md's "Reading paths" section (the duplicate) down to
a pointer at docs/README.md, now the single index. Rewrote
docs/README.md itself to use the new subdirectory paths and added the
one doc it was missing that CLAUDE.md's old copy had (pr-review-gate.md).

Classified all 22 docs/*.md files first via a haiku subagent (mara's
suggestion) on two axes -- proposed grouping and operator-vs-
implementation focus -- before finalizing the taxonomy; spot-checked
the report and found internal inconsistencies (its classification
table disagreed with its own summary section for a few files), so this
taxonomy is my original proposal + the one correction mara gave
directly, not a blind application of the subagent's table. The
operator-focus data it gathered is still useful for a follow-up
content pass (docs skewing 'mixed' rather than pure operator-facing),
not addressed in this PR -- structure only.

nix fmt clean, both pre-push lints clean.

nix/host-modules/hive-gateway/vhosts.nix

@@ -36,13 +36,13 @@ let
   # mints into responses (well-known JSON, the deprecated
   # `<hive>/matrix/*` 301 redirect, future absolute-URL needs):
   # always `https://<host>` (matrix-spec compliance) — the canonical
-  # 443 elides the port. See `docs/gateway.md` ("Self-signed TLS").
+  # 443 elides the port. See `docs/networking/gateway.md` ("Self-signed TLS").
   publicScheme = "https";
   publicPort = cfg.httpsPort;
   publicPortSuffix = if publicPort == 443 then "" else ":${toString publicPort}";
 
   # `<hive>/matrix/*` → 301 → `matrix.<hive>/$1` (legacy deep-link
-  # shim during the fluffychat sub-domain move). See `docs/gateway.md`.
+  # shim during the fluffychat sub-domain move). See `docs/networking/gateway.md`.
   matrixRedirectLocations =
     lib.optionalAttrs (matrixCfg.enable && matrixCfg.gui.enable && matrixCfg.gatewayHost != null)
       (
@@ -61,7 +61,7 @@ let
   # `.well-known/matrix/{client,server}` discovery JSON. Points
   # clients at `matrixCfg.gatewayHost` when set; falls back to direct
   # `<hive>:<httpPort>`. CORS `*` per matrix spec. The `m.server`
-  # port-8448 carve-out is documented inline. See `docs/gateway.md`.
+  # port-8448 carve-out is documented inline. See `docs/networking/gateway.md`.
   wellKnownLocations = lib.optionalAttrs matrixCfg.enable (
     let
       clientBaseUrl =
@@ -77,7 +77,7 @@ let
       # (which drops :443) is right for the client base_url above but
       # wrong for federation delegation. Without this, peers federate to
       # <gatewayHost>:8448 (closed) while the endpoint actually lives on
-      # the gateway's 443 vhost. See docs/gateway.md discovery flow.
+      # the gateway's 443 vhost. See docs/networking/gateway.md discovery flow.
       serverHostPort =
         if matrixCfg.gatewayHost != null then
           "${matrixCfg.gatewayHost}:${toString publicPort}"