fix(#3245): resolve the remaining intra-doc links in hive-c0re

Takes the crate from 26 rustdoc warnings to 1, on top of the ten in the
previous commit.

argus's review findings:
- agent_sockets.rs: [`write`] was still ambiguous (function vs macro).
  The previous change narrowed the qualifier and left the ambiguity;
  [`write()`] is what resolves it.
- forge/users.rs <hex> and stats/container_stats.rs <name>: unclosed
  HTML tags in prose, now backticked.

The rest of the crate, so the count actually reaches zero:
- job_queue/mod.rs: Queue::graph_snapshot -> JobQueue::graph_snapshot
  (there is no Queue type), and super::scheduler -> scheduler (mod.rs
  *is* job_queue, so super:: pointed outside it)
- job_queue/resource.rs: NodeKind -> super::model::NodeKind
- matrix.rs: password_path(name) -> password_path; and
  forge::provision_user_token -> crate::forge::provision_user_token.
  Note the path has no `users` segment: forge/mod.rs declares `mod
  users` private and re-exports it, so the canonical path comes from the
  re-export rather than the directory tree.
- socket_server/lifecycle_handlers.rs: InfraContainer ->
  hive_priv_sock::InfraContainer
- stats/otel_metrics.rs: crate::meta::otel_config is a private fn no
  path can name from another module, so it becomes prose
- main.rs: redundant explicit link target dropped

coordinator.rs:405 (CrashWatchGuard) is deliberately untouched: #3244
deletes that doc block, so fixing it here would conflict with an open PR
and repair a symbol that is about to stop existing.

hive-c0re/src/job_queue/mod.rs

@@ -279,7 +279,7 @@ impl JobQueue {
     /// difference from the older lease-declaration test: lease-exemption is
     /// exactly what lets one DAG build for `a` while another holds `a`'s lease,
     /// so both are running and both name `a`. Anything keying this set by agent
-    /// alone will silently drop one — see [`super::scheduler`].
+    /// alone will silently drop one — see [`scheduler`].
     ///
     /// `label` is the node's own wire tag ([`NodeKind::as_str`]), the same
     /// vocabulary the graph wire ships as a node's label, so a pill and a
@@ -361,7 +361,7 @@ impl JobQueue {
         filter_nodes_by_state(nodes, states)
     }
 
-    /// Per-state counts over the **same** groups [`Queue::graph_snapshot`]
+    /// Per-state counts over the **same** groups [`JobQueue::graph_snapshot`]
     /// serves.
     ///
     /// Supplies the same two things and nothing else: the lock, and
@@ -413,7 +413,7 @@ fn find_node(sched: &Sched, id: u64) -> Option<NodeId> {
         .find_map(|n| (n.id.get() == id).then_some(n.id))
 }
 
-/// [`Queue::graph_snapshot`]'s `states` ask, applied to the already-
+/// [`JobQueue::graph_snapshot`]'s `states` ask, applied to the already-
 /// projected node list: keeps every node — root or descendant — whose own
 /// `state` is named.
 ///
@@ -433,7 +433,7 @@ fn filter_nodes_by_state(nodes: Vec<GraphNode>, states: Option<&[State]>) -> Vec
         .collect()
 }
 
-/// The visible **group** set for [`Queue::graph_snapshot`]: every live group
+/// The visible **group** set for [`JobQueue::graph_snapshot`]: every live group
 /// root, plus the newest [`MAX_HISTORY_DAGS`] settled ones.
 ///
 /// Selected *structurally* — a root is a node with no parent. The typed

hive-c0re/src/job_queue/resource.rs

@@ -1,7 +1,7 @@
 //! The concrete resource type the rebuild queue schedules over — the bridge
-//! from hive-c0re's [`NodeKind`] onto the domain-agnostic `hive-jobq` crate.
+//! from hive-c0re's [`super::model::NodeKind`] onto the domain-agnostic `hive-jobq` crate.
 //! `hive-jobq` is generic over a resource type `R: Clone + Eq + Hash` and a node
-//! payload `N`; here `R` is [`Resource`] and `N` is [`NodeKind`] directly (each
+//! payload `N`; here `R` is [`Resource`] and `N` is [`super::model::NodeKind`] directly (each
 //! variant carries the agent it targets).
 //!
 //! **A node's resources are declared where the node is constructed** with