docs: move narrative wiki under knowledge/wiki/ (phase 3)

Problem: node and cross-cutting narratives lived at the repo root
(containers/, vms/, infrastructure/, host .md files), interleaved with the
machine-readable substrate.

Change:
- Move containers/ -> knowledge/wiki/containers/, vms/ -> knowledge/wiki/vms/,
  infrastructure/ -> knowledge/wiki/infrastructure/, hosts/{hubris,strong}.md ->
  knowledge/wiki/hosts/, infrastructure/references/ -> knowledge/sources/references/,
  GLOSSARY.md -> knowledge/GLOSSARY.md.
- Add knowledge/{index.md,log.md,sources/index.md} scaffolding.
- Rewrite all relative links repo-wide via a path-resolving mapper (inbound +
  outbound + between-moved-files), including .hermes/, runbooks, operations,
  investigations, plans, README, AGENTS.
- Repoint inventory.yaml doc_page fields and regenerate hosts/*.yaml (which
  embed doc_page); update oikos/gen-topology.py output path, candidate doc
  paths, and footer links; update code-comment doc paths.

Substrate untouched in place: inventory.yaml, hosts/*.yaml (regenerated,
idempotent), oikos/ code, mcp/, secrets/, bin/.

Verification:
- Logical broken-link set identical to pre-move baseline (net 128 -> 127; the
  topology regen fixed one, introduced none). Remaining are pre-existing refs
  to destroyed/archived nodes, out of scope for this move.
- gen-topology.py --check exit 0 (in sync); cards carry knowledge/wiki/ doc paths.
- build_host_files.py idempotent; all inventory doc_page targets resolve.
- MCP contract verified: get_page/search_docs/get_changelog resolve moved pages.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

knowledge/wiki/containers/133-seanime.md

@@ -0,0 +1,61 @@
+# seanime (LXC 133) — Seanime anime media server
+
+## Summary
+
+| Field | Value |
+|-------|-------|
+| VMID | 133 |
+| Host | strong |
+| Role | Anime media server (online streaming + torrent client) |
+| LAN IP | 192.168.8.248/28 (vmbr1) |
+| Public URL | https://seanime.hubris.network |
+| Backend | Seanime v3.9.0, systemd service |
+| Port | 43211 |
+
+## Mounts
+
+- `/anime` → `/mnt/media_local/anime` (ludo-lvm, bind mount) — existing anime collection
+
+## Services
+
+### Seanime (native binary)
+
+- Binary: `/opt/seanime/bin/seanime`
+- Data: `/opt/seanime/data/`
+- Config: `/opt/seanime/data/config.toml`
+- Service: `systemctl status seanime`
+- Flags: `--host 0.0.0.0 --port 43211 --datadir /opt/seanime/data --disable-password`
+- Config highlights:
+  - `secureMode = 'lax'` (allows non-local Caddy proxy)
+  - `trustedProxies = ['192.168.8.0/24']`
+
+### Torrent client (qBittorrent on arriman)
+
+- Host: `192.168.8.245:8080`
+- Auth: subnet whitelist (no password needed from homelab LAN)
+- qBittorrent config updated: `AuthSubnetWhitelist=192.168.8.0/24`
+
+### Extensions installed
+
+**Online streaming (8):**
+HiAnime, AniWatch, KickAssAnime, Anicrush, Animo, AniNeko, Senshi, Sudatchi
+
+## Caddy
+
+- Config: `seanime.hubris.network` block in `/etc/caddy/Caddyfile` (dtoro/caddy-conf repo)
+- TLS: Let's Encrypt DNS-01 via IONOS API
+- Backend: `192.168.8.248:43211`
+
+## DNS
+
+- `seanime.hubris.network` A record → `192.168.8.175` (Caddy)
+
+## Changelog
+
+### 2026-07-05 — initial creation
+- LXC 133 created on strong (Debian 13, 2 cores / 2 GiB)
+- Seanime v3.9.0 installed as native binary + systemd service
+- /anime bind mount from ludo-lvm
+- qBittorrent on arriman configured as torrent client
+- Caddy reverse proxy + DNS records set up
+- Online streaming extensions installed