db as source of truth: wiki→seeds, archive old artifacts, knowledge ingestion

- Migrations 010 (content_hash) + 011 (search tsvector column)
- new: internal/knowledge/seed.go — knowledge seed ingest engine
- new: internal/httpapi/knowledge.go — SearchKnowledge + GetEntityKnowledge
- wire knowledge ingest into oikos seed pipeline
- convert all 36 wiki docs + 6 investigations + 12 runbooks → seeds/knowledge.yaml
- archive: knowledge/wiki/→archive/, oikos/cards/→archive/, .hermes/plans/→archive/
- delete: 9 superseded Python kernel files, ledger/, mcp/build_host_files.py
- remove empty knowledge/ directory tree

archive/oikos-cards/cards/service-caddy.md

@@ -0,0 +1,20 @@
+# caddy (service:caddy)
+
+- backend: host:caddy
+- doc: knowledge/wiki/containers/121-caddy.md
+- config repo: dtoro/caddy-conf
+- risk notes: wide blast radius — every *.hubris.network route rides on it (see oikos/policy.yaml service_overrides)
+
+## Blast radius
+- impacts: (none)
+- affected by: host:caddy
+
+## Safe actions
+- health-check — read_only (approval: none)
+- view-logs — read_only (approval: none)
+- view-docs — read_only (approval: none)
+- restart — config_mutation (approval: operator)
+- edit-config-and-deploy — config_mutation (approval: operator)
+
+## Recent changes
+- 2026-07-06T11:29:56+00:00 add-site-block (config_mutation) — ok