docs: move narrative wiki under knowledge/wiki/ (phase 3)

Problem: node and cross-cutting narratives lived at the repo root
(containers/, vms/, infrastructure/, host .md files), interleaved with the
machine-readable substrate.

Change:
- Move containers/ -> knowledge/wiki/containers/, vms/ -> knowledge/wiki/vms/,
  infrastructure/ -> knowledge/wiki/infrastructure/, hosts/{hubris,strong}.md ->
  knowledge/wiki/hosts/, infrastructure/references/ -> knowledge/sources/references/,
  GLOSSARY.md -> knowledge/GLOSSARY.md.
- Add knowledge/{index.md,log.md,sources/index.md} scaffolding.
- Rewrite all relative links repo-wide via a path-resolving mapper (inbound +
  outbound + between-moved-files), including .hermes/, runbooks, operations,
  investigations, plans, README, AGENTS.
- Repoint inventory.yaml doc_page fields and regenerate hosts/*.yaml (which
  embed doc_page); update oikos/gen-topology.py output path, candidate doc
  paths, and footer links; update code-comment doc paths.

Substrate untouched in place: inventory.yaml, hosts/*.yaml (regenerated,
idempotent), oikos/ code, mcp/, secrets/, bin/.

Verification:
- Logical broken-link set identical to pre-move baseline (net 128 -> 127; the
  topology regen fixed one, introduced none). Remaining are pre-existing refs
  to destroyed/archived nodes, out of scope for this move.
- gen-topology.py --check exit 0 (in sync); cards carry knowledge/wiki/ doc paths.
- build_host_files.py idempotent; all inventory doc_page targets resolve.
- MCP contract verified: get_page/search_docs/get_changelog resolve moved pages.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

knowledge/wiki/infrastructure/index.md

@@ -0,0 +1,66 @@
+# Infrastructure — cross-cutting systems
+
+The homelab's shared infrastructure: systems that span multiple nodes and
+are documented in their own pages. Each system below links to its full doc.
+
+## Network
+
+- **[Network](network.md)** — physical topology, subnets, routing, DHCP.
+  Homelab `192.168.8.0/24` isolated from household `192.168.178.0/24`.
+  Proxmox hubris acts as subnet router.
+- **[DNS — split-horizon](dns.md)** — Technitium DNS on LXC 107,
+  `192.168.8.2:53`. `*.hubris.network` resolves to LAN IPs on the homelab
+  network and to mesh addresses off-LAN.
+
+## Connectivity / mesh
+
+- **[Mesh — Tailscale → Netbird migration](mesh.md)** — overlay networking.
+  Netbird is the preferred path; Tailscale is legacy.
+- **[SSH access](ssh-access.md)** — dual-server SSH (OpenSSH + Netbird SSH)
+  on hubris, key distribution.
+
+## Public ingress
+
+- **[Public ingress — VPS traefik + cert mirror](ingress.md)** — how home
+  services reach the open internet. Two-stage: VPS traefik (IONOS) terminates
+  TLS, proxies over Netbird to home Caddy.
+- **[Caddy reverse proxy](../containers/121-caddy.md)** — LAN endpoint.
+  Terminates TLS for every `*.hubris.network` hostname, forwards to backends.
+
+## Storage
+
+- **[Media permissions — GID 10000 standard](media-permissions.md)** — shared
+  group permission model across all LXCs that read/write the media library.
+- **[Backups — rclone → Proton Drive](backups.md)** — off-host backup strategy.
+  LXC 132 handles rclone to Proton Drive; restic-on-USB deprecated.
+
+## Identity & access
+
+- **[Authentik SSO](../containers/124-authentik.md)** — identity provider.
+  Core server runs on the VPS; LAN forward-auth outpost at LXC 106.
+  OIDC providers configured for Jellyfin, Jellyseerr, Sabnzbd, qBittorrent,
+  Yuvomi, and more.
+
+## Management & automation
+
+- **[Homelab context distribution](homelab-context.md)** — `/opt/homelab-context`
+  clone, MCP server, secrets issuance, cross-client sync.
+- **[Auto-deploy — gitea-webhook pipelines](auto-deploy.md)** — push-to-deploy
+  for Caddy config, mule-image, and other tracked repos.
+- **[Monitoring](monitoring.md)** — health checks, watchdogs, alerting
+  (migrated from claudio-bot to Hermes cron).
+- **[VPS hardening](vps-hardening.md)** — IONOS netbird VPS: fail2ban,
+  nftables, OIDC SSH, security posture.
+
+## Topology
+
+- **[Topology diagram (generated)](topology.md)** — Mermaid graph of compute,
+  ingress routing, and storage mounts. Auto-generated from `inventory.yaml`
+  by `oikos/gen-topology.py`.
+
+## Related
+
+- [README](../../../README.md) — entry point
+- [Containers index](../containers/index.md)
+- [Operations cheatsheet](../../../operations/commands.md)
+- [OIKOS operating model](../../../OIKOS.md)