docs: fix 329 Microsoft.Contractions hits with proper safety checks

Apply contraction fixes across ~40 doc files (setup, integrations, lifecycle,
networking, scheduler, swarm, tools, trust-boundary, UI, etc.). Skipped 14 hits:
- 10 where words appear in ALL CAPS for deliberate emphasis (is NOT, do NOT, etc.)
- 4 where text could not be safely located due to markdown formatting or column position

Applied via systematic scan with checks for fenced code blocks, inline code spans,
and intentional caps. Preserves sentence-initial capitalization throughout.

docs/integrations/matrix.md

@@ -31,7 +31,7 @@ Two distinct hostnames:
 
 - **`serverName`** — matrix-spec `server_name`, embedded
   *irrevocably* in every `@user:<server_name>` and `!room:<server_name>`
-  identifier minted on this homeserver. Cannot be changed later
+  identifier minted on this homeserver. can't be changed later
   without abandoning every account and chat history. Defaults to the
   bare `services.hyperhive.swarm.domain`; clients auto-discover the
   actual API endpoint via the `.well-known/matrix/{client,server}`
@@ -46,9 +46,9 @@ homeserver: tying its identity to a single hive's domain would make
 relocating the container between hives look like a different
 homeserver.
 
-⚠️ **They are still not interchangeable, and the difference is the
+⚠️ **they're still not interchangeable, and the difference is the
 cost of changing one.** `gatewayHost` is a routing detail clients
-rediscover through `.well-known`, so it is safe to move on a running
+rediscover through `.well-known`, so it's safe to move on a running
 deployment. `serverName` is baked into every user and room id, so
 adopting a new one does **not** rename the existing users and rooms —
 it strands them, because their ids still name a homeserver that no
@@ -71,8 +71,8 @@ services.hyperhive.swarm.matrix = {
 
 A rebuild on a host that already has a homeserver prints a
 `hive-matrix: WARNING — … serverName is unset` line when this is missing,
-naming the value it is about to default to. That warning is why this
-section exists; it never fails the rebuild, so it is on you to act on it
+naming the value it's about to default to. That warning is why this
+section exists; it never fails the rebuild, so it's on you to act on it
 before the ids are minted.
 
 ## Default-closed firewall
@@ -147,13 +147,13 @@ Initial rollout settings:
   external / federated homeservers or to keep contents opaque to the
   homeserver admin. **The agent matrix client always supports decryption
   regardless of this flag** — it uses the `e2e-encryption` feature of
-  `matrix-sdk` so it can read encrypted rooms it is invited to even when
+  `matrix-sdk` so it can read encrypted rooms it's invited to even when
   this homeserver doesn't permit room encryption. Crypto keys are stored
   in the per-agent sqlite store under the state dir and persist across
   restarts (lost on `--purge`). `read_room` decrypts via
   `room.messages()` — UTD events surface as `event_type =
   "m.room.encrypted"` with `body = "[unable to decrypt]"`.
-  Cross-signing and automatic key backup are not enabled for the first
+  Cross-signing and automatic key backup aren't enabled for the first
   pass: static bearer-token bot accounts can't bootstrap cross-signing
   without MSC3967.
 
@@ -227,7 +227,7 @@ homeserver at all rather than of a setting:
   tuwunel reads its identity providers from the config file, so a
   half-configured one can stop the homeserver from starting outright
   rather than merely hiding a login button. On a host that also runs
-  the swarm's authelia it is wired up for you.
+  the swarm's authelia it's wired up for you.
 - **`swarm.authelia.url` is required** — without a provider URL there
   is nothing to discover against.
 - **`gatewayHost != null` is required** — the SSO callback URL is