docs: restructure into topic subdirectories, collapse duplicated index

Per mara's go-ahead on hyperhive#3902 ("getting started is good, but
terminal rendering does not go in there i think"):

Moved 21 top-level docs/*.md files into 7 new topic subdirectories
(existing web-ui/, turn-loop/, swarm/, tools/, crates/ untouched):
  getting-started/  setup.md
  agent-lifecycle/  agent-hierarchy.md, approvals.md, persistence.md
  trust-boundary/   boundary.md, security.md
  integrations/     forge.md, matrix.md, github.md, knowledge.md
  networking/       gateway.md, network.md, snapshot-store.md
  scheduler/        jobq.md, coordinator.md, ci.md, observability.md
  process/          conventions.md, gotchas.md, pr-review-gate.md
  web-ui/           terminal-rendering.md (moved into the EXISTING dir,
                    per mara's correction to the original getting-started
                    guess -- it's UI implementation detail, not onboarding)

The physical layout now matches docs/README.md's own topical headers,
which already amounted to this taxonomy -- see the scoping comment on
the issue for the two findings that motivated this (a genuine
duplication between CLAUDE.md's old "Reading paths" list and
docs/README.md's grouped one, since drifted out of sync with each
other; and the flat layout not matching the grouping we already had).

Fixed every cross-reference this moved across the whole repo (~120
files: docs/ internal links at every depth, Rust doc comments, nix
module option docs, crate READMEs) -- verified two ways: a grep sweep
confirming zero remaining references to any old path, and a script
that resolves every markdown link in docs/**/*.md + CLAUDE.md +
README.md against the filesystem and reports anything that doesn't
exist (zero broken links).

Collapsed CLAUDE.md's "Reading paths" section (the duplicate) down to
a pointer at docs/README.md, now the single index. Rewrote
docs/README.md itself to use the new subdirectory paths and added the
one doc it was missing that CLAUDE.md's old copy had (pr-review-gate.md).

Classified all 22 docs/*.md files first via a haiku subagent (mara's
suggestion) on two axes -- proposed grouping and operator-vs-
implementation focus -- before finalizing the taxonomy; spot-checked
the report and found internal inconsistencies (its classification
table disagreed with its own summary section for a few files), so this
taxonomy is my original proposal + the one correction mara gave
directly, not a blind application of the subagent's table. The
operator-focus data it gathered is still useful for a follow-up
content pass (docs skewing 'mixed' rather than pure operator-facing),
not addressed in this PR -- structure only.

nix fmt clean, both pre-push lints clean.

nix/host-modules/hive-matrix.nix

@@ -84,7 +84,7 @@ let
   # skips the dart web-worker compile + the emscripten native_imaging
   # build. Two derivations below cover both. Full rationale (why
   # passthru.pubspecLock.dependencySources, why `dontConfigure`, why
-  # `make -C js`, why build-CWD-relative dart path): docs/matrix.md::
+  # `make -C js`, why build-CWD-relative dart path): docs/integrations/matrix.md::
   # fluffychat-web build fixes.
 
   fluffychat-web-imaging = pkgs.stdenv.mkDerivation {
@@ -153,8 +153,8 @@ in
   # optional fluffychat-web client at matrix.<hive>/. Container shape,
   # serverName vs gatewayHost split, provisioning flow (registration
   # token + LoadCredential), assertion rationale, initial rollout
-  # settings: docs/matrix.md. Vhost map + discovery flow + tuning
-  # knobs: docs/gateway.md.
+  # settings: docs/integrations/matrix.md. Vhost map + discovery flow + tuning
+  # knobs: docs/networking/gateway.md.
 
   # Matrix moved under `swarm` when the swarm-global services were
   # consolidated. One rename for the namespace: the subtree comes with it,
@@ -291,7 +291,7 @@ in
         Defaults to `chat.''${services.hyperhive.swarm.domain}` — the
         swarm's domain, because a swarm runs **one** homeserver. Set to
         `null` to skip the gateway vhost (tuwunel stays direct on
-        `httpPort`). See `docs/gateway.md` for the vhost map + matrix
+        `httpPort`). See `docs/networking/gateway.md` for the vhost map + matrix
         discovery flow, and the federation port-8448 caveat at the
         bottom of that doc.
 
@@ -410,7 +410,7 @@ in
           Requires `matrix.gatewayHost != null` (default `matrix.<hive>`
           when hive-domain set); the gateway itself always runs. When
           off, the dashboard's `M4TR1X →` tab is hidden. See
-          `docs/gateway.md` for the discovery flow that lets clients
+          `docs/networking/gateway.md` for the discovery flow that lets clients
           auto-find the sub-domain.
         '';
       };
@@ -528,7 +528,7 @@ in
         };
 
     # Accept-header SPA map, used only by the `/` location below (see
-    # docs/gateway.md "SPA fallback"): text/html → index.html, else a
+    # docs/networking/gateway.md "SPA fallback"): text/html → index.html, else a
     # sentinel so `try_files` falls through to 404. `appendHttpConfig`
     # is a `lines` option, so this merges with anything else the host
     # contributes instead of replacing it.
@@ -601,7 +601,7 @@ in
     # hive-network.nix) when not set explicitly, so no separate
     # domain/serverName assertion is needed here. gatewayHost may not be
     # "" (same footgun as forge.domain — nginx rejects an empty
-    # server_name). docs/matrix.md::Assertion rationale.
+    # server_name). docs/integrations/matrix.md::Assertion rationale.
     assertions = [
       {
         assertion = cfg.gatewayHost == null || cfg.gatewayHost != "";
@@ -764,7 +764,7 @@ in
     # Activation-time token generation — without this the bind-mount
     # would hand tuwunel an empty file on first boot and break every
     # registration until restart. Idempotent;
-    # docs/matrix.md::Provisioning flow.
+    # docs/integrations/matrix.md::Provisioning flow.
     # Tell an operator whose homeserver already exists that `serverName` is
     # unpinned, at the one moment they are looking: the rebuild.
     #
@@ -895,7 +895,7 @@ in
           # `environment.etc."resolv.conf".text` is `nameserver <bridgeIp>`.
           # This container always shares the host netns
           # (`privateNetwork = false`), so it reaches `bridgeIp` regardless
-          # of agent-container isolation. See `docs/network.md`.
+          # of agent-container isolation. See `docs/networking/network.md`.
           networking = {
             # resolvconf is taken out of the loop entirely; the static
             # `environment.etc."resolv.conf"` below is the sole source of