docs: move narrative wiki under knowledge/wiki/ (phase 3)

Problem: node and cross-cutting narratives lived at the repo root
(containers/, vms/, infrastructure/, host .md files), interleaved with the
machine-readable substrate.

Change:
- Move containers/ -> knowledge/wiki/containers/, vms/ -> knowledge/wiki/vms/,
  infrastructure/ -> knowledge/wiki/infrastructure/, hosts/{hubris,strong}.md ->
  knowledge/wiki/hosts/, infrastructure/references/ -> knowledge/sources/references/,
  GLOSSARY.md -> knowledge/GLOSSARY.md.
- Add knowledge/{index.md,log.md,sources/index.md} scaffolding.
- Rewrite all relative links repo-wide via a path-resolving mapper (inbound +
  outbound + between-moved-files), including .hermes/, runbooks, operations,
  investigations, plans, README, AGENTS.
- Repoint inventory.yaml doc_page fields and regenerate hosts/*.yaml (which
  embed doc_page); update oikos/gen-topology.py output path, candidate doc
  paths, and footer links; update code-comment doc paths.

Substrate untouched in place: inventory.yaml, hosts/*.yaml (regenerated,
idempotent), oikos/ code, mcp/, secrets/, bin/.

Verification:
- Logical broken-link set identical to pre-move baseline (net 128 -> 127; the
  topology regen fixed one, introduced none). Remaining are pre-existing refs
  to destroyed/archived nodes, out of scope for this move.
- gen-topology.py --check exit 0 (in sync); cards carry knowledge/wiki/ doc paths.
- build_host_files.py idempotent; all inventory doc_page targets resolve.
- MCP contract verified: get_page/search_docs/get_changelog resolve moved pages.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

inventory.yaml

@@ -48,26 +48,26 @@ services:
     url: https://proxmox.hubris.network
     backend: hubris
     port: 8006
-    doc_page: hosts/hubris.md
+    doc_page: knowledge/wiki/hosts/hubris.md
     risk_notes: hypervisor UI — changes here affect every guest on the node
   gitea:
     url: https://git.hubris.network
     backend: gitea
     backend_url: http://192.168.8.121:3000
-    doc_page: containers/104-gitea.md
+    doc_page: knowledge/wiki/containers/104-gitea.md
     config_repo: dtoro/gitea-customizations
     risk_notes: hosts all config repos + deploy webhooks; outage blocks auto-deploy and sync
   caddy:
     backend: caddy
     role: reverse-proxy
     note: terminates all *.hubris.network
-    doc_page: containers/121-caddy.md
+    doc_page: knowledge/wiki/containers/121-caddy.md
     config_repo: dtoro/caddy-conf
     risk_notes: wide blast radius — every *.hubris.network route rides on it (see oikos/policy.yaml service_overrides)
   authentik:
     url: https://auth.hubris.network
     backend: netbird-vps
-    doc_page: containers/106-auth-outpost.md
+    doc_page: knowledge/wiki/containers/106-auth-outpost.md
     note: >-
       core runs on the VPS since 2026-05-31; LAN forward-auth outpost is
       auth-outpost (LXC 106) at 192.168.8.6:9000. Previous backend value
@@ -76,58 +76,58 @@ services:
   dns:
     backend: dns
     note: Technitium DNS, split-horizon zone
-    doc_page: containers/107-dns.md
+    doc_page: knowledge/wiki/containers/107-dns.md
     risk_notes: LAN-wide resolver — misconfig breaks name resolution for every client
   jellyfin:
     url: https://media.hubris.network
     backend: jellyfin
-    doc_page: containers/101-jellyfin.md
+    doc_page: knowledge/wiki/containers/101-jellyfin.md
     risk_notes: native Authentik OIDC via SSO-Auth plugin, no Caddy forward-auth gate; VAAPI transcode depends on GPU passthrough on strong
   nextcloud:
     url: https://cloud.hubris.network
     backend: nextcloud
-    doc_page: containers/114-nextcloud.md
+    doc_page: knowledge/wiki/containers/114-nextcloud.md
   paperless:
     url: https://paperless.hubris.network
     backend: paperless
-    doc_page: containers/103-paperless.md
+    doc_page: knowledge/wiki/containers/103-paperless.md
     risk_notes: document archive — treat data as irreplaceable; DB operations are destructive-class
   matrix:
     url: https://matrix.hubris.network
     backend: elementsynapse
-    doc_page: containers/118-elementsynapse.md
+    doc_page: knowledge/wiki/containers/118-elementsynapse.md
     risk_notes: alert/approval channel for Oikos — outage silences agent escalation
   photos:
     url: https://photos.hubris.network
     backend: mule-images
-    doc_page: containers/120-mule-images.md
+    doc_page: knowledge/wiki/containers/120-mule-images.md
     config_repo: dtoro/mule-image
   arr_stack:
     backend: arriman
     note: jellyseerr / qbit / sab on docker compose
-    doc_page: containers/122-arriman.md
+    doc_page: knowledge/wiki/containers/122-arriman.md
   artifacto:
     backend: apps
     url: https://artifacto.hubris.network
-    doc_page: containers/105-apps.md
+    doc_page: knowledge/wiki/containers/105-apps.md
     config_repo: dtoro/Artifacto
   trmnl:
     backend: trmnl
     url: https://trmnl.hubris.network
     note: self-hosted middleware for TRMNL e-ink plugins (polled by TRMNL cloud)
-    doc_page: containers/128-trmnl.md
+    doc_page: knowledge/wiki/containers/128-trmnl.md
     config_repo: dtoro/terminalito
   zimaos:
     url: https://zimaos.hubris.network
     backend: zimaos
-    doc_page: vms/100-zimaos.md
+    doc_page: knowledge/wiki/vms/100-zimaos.md
   haos:
     backend: haos
-    doc_page: vms/108-haos.md
+    doc_page: knowledge/wiki/vms/108-haos.md
   teddycloud:
     url: https://teddy.hubris.network
     backend: teddycloud
-    doc_page: containers/131-teddycloud.md
+    doc_page: knowledge/wiki/containers/131-teddycloud.md
     note: self-hosted TeddyCloud (Toniebox cloud reimplementation), docker compose
     risk_notes: no Caddy forward-auth gate (unlike sab.hubris.network on the same Caddyfile) —
       reachable to anyone on the LAN/mesh who can resolve teddy.hubris.network; undocumented
@@ -138,7 +138,7 @@ services:
     systemd_unit: homelab-mcp
     public_host: mcp.hubris.network
     endpoint: https://mcp.hubris.network/mcp
-    doc_page: infrastructure/homelab-context.md
+    doc_page: knowledge/wiki/infrastructure/homelab-context.md
     config_repo: dtoro/Homelab-Docs
     note: MCP server. Read-only context + management. Reachable on the LAN via Caddy
       and from off-LAN via Netbird (192.168.8.0/24 is a network resource routed through