db as source of truth: wiki→seeds, archive old artifacts, knowledge ingestion

- Migrations 010 (content_hash) + 011 (search tsvector column)
- new: internal/knowledge/seed.go — knowledge seed ingest engine
- new: internal/httpapi/knowledge.go — SearchKnowledge + GetEntityKnowledge
- wire knowledge ingest into oikos seed pipeline
- convert all 36 wiki docs + 6 investigations + 12 runbooks → seeds/knowledge.yaml
- archive: knowledge/wiki/→archive/, oikos/cards/→archive/, .hermes/plans/→archive/
- delete: 9 superseded Python kernel files, ledger/, mcp/build_host_files.py
- remove empty knowledge/ directory tree

archive/knowledge/investigations/index.md

@@ -0,0 +1,29 @@
+# Investigations
+
+Time-stamped incident reports and experiments. One entry per incident; the entry is the canonical source. Per-node changelog entries link back here.
+
+## Active / recent
+
+| Date         | Title                                                              | Status        |
+| ------------ | ------------------------------------------------------------------ | ------------- |
+| 2026-06-06   | [Caddyfile truncation incident](2026-06-06-caddyfile-truncation.md) | Resolved — permanent safeguards deployed (site-count guard, auto-stash, auto-backup) |
+| 2026-06-06   | [Frequent Authentik login prompts — session lifetime fix](2026-06-06-authentik-session-lifetime.md) | Resolved — `session_duration=days=30`, `SESSION_COOKIE_AGE=30d` |
+| 2026-06-03   | [Moonlight/Sunshine streaming — WiFi jitter](2026-06-03-moonlight-sunshine-wifi-jitter.md) | Mitigations applied; definitive fix requires wiring mac-mini via Ethernet |
+| 2026-06-01   | [Mac-mini onboarding](2026-06-01-mac-mini-onboarding.md) | Onboarded |
+
+## Resolved (archived)
+
+See [`archive/`](archive/):
+
+| Date         | Title                                                              |
+| ------------ | ------------------------------------------------------------------ |
+| 2026-04-21   | [Hubris crash loop — thermal + USB drive](archive/2026-04-21-hubris-crash-loop.md) |
+| 2026-05-31   | [Authentik migrated from LXC 124 to the VPS](archive/2026-05-31-authentik-vps-migration.md) |
+
+## Conventions
+
+- File name: `YYYY-MM-DD-<slug>.md`. Use the *first* date if the incident spans multiple days.
+- Mandatory sections: Summary, Timeline, Root cause, Mitigations applied, Open questions.
+- Update the entry as the situation evolves; never rewrite history. Add new dated sections at the bottom.
+- Link back from every node's changelog that's affected.
+- Move to `archive/` when the incident is fully resolved and no longer actively referenced.