feat(#1997): add prettier markdown formatter to treefmt

- .prettierrc: proseWrap=preserve (no prose reflow)
- .prettierignore: exclude hivectl-cli.md (auto-generated) + 11 docs
  with multi-line list-item continuations prettier would strip to col 0
  (CommonMark limitation in prettier's list handling)
- format 16 markdown files: cosmetic only (*→_, table alignment,
  heading normalisation) — verified no broken continuations, idempotent

docs/swarm.md

@@ -48,12 +48,12 @@ services.hyperhive.swarm.peers = {
 The attrset key is the peer's DNS domain. Two independent, optional
 trust knobs — pick by what you need to trust:
 
-- **`certFingerprint`** (`"sha256:…"`) — pin the peer's TLS *leaf*
+- **`certFingerprint`** (`"sha256:…"`) — pin the peer's TLS _leaf_
   fingerprint. Scopes **only** to hive-c0re's own peer HTTPS checks
   (the P33RS dashboard links + agent peer discovery below). It is
   **not** consulted by matrix federation — tuwunel validates a peer's
   federation certificate against the system CA bundle independently
-  (see *Matrix federation* below), so a fingerprint pin does nothing
+  (see _Matrix federation_ below), so a fingerprint pin does nothing
   for a self-signed matrix cert.
 - **`caCert`** (path to the peer's root CA PEM) — embeds that CA (at
   build time, into the nix store — no runtime file on the host) and
@@ -61,7 +61,7 @@ trust knobs — pick by what you need to trust:
   alongside `hive-ca.pem` in every agent's
   `security.pki.certificateFiles` (via the meta-flake renderer) **and**
   in the matrix container's trust bundle, so tuwunel validates the
-  peer's *federation* TLS when it chains to that CA. Trust stays
+  peer's _federation_ TLS when it chains to that CA. Trust stays
   **inside the hive** (agents + the matrix container), never the host
   system trust store. **This is the knob that unblocks federation with
   a self-signed peer hive** — use it instead of `certFingerprint` when