docs: fix pre-existing broken links surfaced by docs-lint

Problem: docs-lint (added in the wiki-hq reorg) surfaced 126 broken relative
links that predated this session — a container rename, incident/plan docs
that moved into archive/done subfolders without their inbound links being
updated, and a handful of relative-depth bugs in files nested under
containers/archive/ and plans/done/.

Fixes applied, by category:
- 124-authentik.md -> 106-auth-outpost.md (container was renamed; ~40 refs).
- investigations/{2026-04-21-hubris-crash-loop,2026-05-31-authentik-vps-migration}.md
  -> archive/ prefix (both moved to investigations/archive/ previously).
- plans/{2026-06-01-slate-ax-to-sodola-migration,2026-06-04_130000-deprecate-claudio-bot,
  2026-06-25-yuvomi-deployment}.md -> plans/done/ prefix.
- Depth bugs in files nested one level deeper than their siblings assumed
  (investigations/archive/*, knowledge/wiki/containers/archive/*,
  plans/done/*) — corrected relative-path depth.
- Destroyed containers with no surviving page (126-plato) delinked to the
  containers/index.md archaeology row instead of a 404.
- ludo-mini.yaml -> strong.yaml (host was renamed, same physical machine).
- netbird-vps.md (no narrative page exists) -> netbird-vps.yaml (substrate
  record, matching the existing convention for hosts without a wiki page).
- runbook-dpkg-interrupted.md refs -> .agents/skills/runbook-dpkg-interrupted/SKILL.md
  (missed in the phase-4 runbook move because the referencing files used a
  bare filename, not a runbooks/ prefix).
- One dangling forward-reference to a never-written investigation delinked
  to the actual incident record it was describing.

Left alone: two links in knowledge/wiki/containers/101-jellyfin.md into
devops/homelab-authentik-admin/ — an intentional reference to a sibling repo,
not present in this checkout.

Verification: broken-link count 126 -> 2 (real remainder is the cross-repo
reference above); gen-topology.py --check still exit 0; build_host_files.py
still idempotent; all inventory.yaml doc_page targets still resolve.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

knowledge/wiki/containers/archive/127-mule-photos-new.md

@@ -1,7 +1,7 @@
 # 127 — `mule-photos-new`
 
 Side-by-side **PhotoPrism M0 test** of the `dtoro/mule-image` `new` branch
-at `photos-new.hubris.network`. Production [LXC 120](120-mule-images.md) keeps
+at `photos-new.hubris.network`. Production [LXC 120](../120-mule-images.md) keeps
 running on the legacy stack at `photos.hubris.network` until M5 cutover.
 
 ## At a glance
@@ -11,7 +11,7 @@ running on the legacy stack at `photos.hubris.network` until M5 cutover.
 - **Resources:** 6 cores / 8 GiB RAM / 40 GiB rootfs / 1 GiB swap
 - **Features:** `nesting=1,fuse=1,keyctl=1`
 - **Mounts:** *(none — see scratch copy below)*
-- **Public hostname:** [`photos-new.hubris.network`](../infrastructure/dns.md) → [caddy (121)](121-caddy.md) → split (PhotoPrism `:2342`, sidecar `:8000`, Vite `:5173`)
+- **Public hostname:** [`photos-new.hubris.network`](../../infrastructure/dns.md) → [caddy (121)](../121-caddy.md) → split (PhotoPrism `:2342`, sidecar `:8000`, Vite `:5173`)
 
 ## Stack (`/opt/mule-image`)
 
@@ -65,7 +65,7 @@ unprivileged LXCs can't see through.
 
 ## Auth — Authentik OIDC
 
-PhotoPrism's "Sign in with OIDC" button delegates to [Authentik (124)](124-authentik.md).
+PhotoPrism's "Sign in with OIDC" button delegates to [Authentik (124)](../106-auth-outpost.md).
 
 - **Provider/Application slug:** `mule-photos-new`
 - **Issuer:** `https://auth.hubris.network/application/o/mule-photos-new/`
@@ -111,7 +111,7 @@ Mirrors the LXC 120 pattern.
 Push to the `new` branch on [git.hubris.network/dtoro/mule-image](http://git.hubris.network/dtoro/mule-image) → webhook fires → rebuild. The legacy LXC 120 watches `main` and is unaffected.
 
 **Gitea gotcha:** the receiver IP must be in `[webhook] ALLOWED_HOST_LIST`
-in `/etc/gitea/app.ini` on [LXC 104](104-gitea.md). LXC 127's
+in `/etc/gitea/app.ini` on [LXC 104](../104-gitea.md). LXC 127's
 `192.168.8.181` was missing on first bring-up; every push delivered
 status 0 with the message `webhook can only call allowed HTTP servers`.
 Adding the IP and `systemctl restart gitea` is enough — same list is
@@ -145,10 +145,10 @@ curl -sk --resolve photos-new.hubris.network:443:192.168.8.175 \
 ```
 
 > **Decommissioned 2026-05-22.** The PhotoPrism + sidecar + SvelteKit stack
-> validated here was promoted into production on [LXC 120](120-mule-images.md)
+> validated here was promoted into production on [LXC 120](../120-mule-images.md)
 > via the `Mulimage 2.0` merge (`dtoro/mule-image` commit `70dc1b6`). This
 > page is retained for archaeology; everything below is historic. See the
-> 2026-05-22 entry in [120-mule-images.md](120-mule-images.md#changelog) for
+> 2026-05-22 entry in [120-mule-images.md](../120-mule-images.md#changelog) for
 > the cutover detail.
 
 ## Changelog