Phase 1-4: full doc reorg

Phase 1 — fix stale state after strong migration (Phase 1+2, 2026-07-05)
  - README: corrected IPs (jellyfin 206→246, arriman 132→245, etc.),
    added missing containers (128 trmnl, 129 house, 133 seanime, 134 romm,
    124 authentik), updated last-refreshed date, added strong host context
  - containers/101-jellyfin.md: IP 206→246, host hubris→strong, mount
    /mnt/library→/mnt/media_local, GPU 760M→680M+RX7600, privilege→priv
  - containers/118-elementsynapse.md: IP 239→242, added Host: strong
  - containers/122-arriman.md: IP 132→245, mount→/mnt/media_local, added Host
  - containers/129-house.md: IP 212→244, added Host: strong
  - containers/130-grimmory.md: IP 213→247, mount→/mnt/media_local, added Host
  - containers/121-caddy.md: fixed site list (books→grimmory, removed auth→VPS,
    added house, roms, teddy, trmnl)
  - hosts/strong.md: updated At-a-glance to reflect 7 LXCs hosted
  - containers/123-claudio-bot.md, 127-mule-photos-new.md: archived to
    containers/archive/ (were destroyed LXCs with living pages)
  - inventory.yaml: verified correct — no changes needed

Phase 2 — structural cleanup
  - infrastructure/index.md: one-page overview of all cross-cutting systems
  - runbooks/: moved runbook-budget-from-csv.md and runbook-dpkg-interrupted.md
    from operations/ with YAML frontmatter added
  - plans/done/: moved 4 completed plans out of active view; updated index
  - vms/index.md: added VM index page

Phase 3 — navigation & discoverability
  - GLOSSARY.md: term definitions (Authentik, Caddy, LXC, VAAPI, etc.)
  - README: added table of contents, links to glossary + infrastructure index
  - investigations/: archived 2 resolved cases (crash-loop, authentik-migration)
    to investigations/archive/; updated index with active vs archived sections

Phase 4 — ongoing discipline
  - CONTRIBUTING.md: documented same-session update rule with explicit checklist
  - README: replaced full LXC table with summary + link to containers/index.md
    (single source of truth; de-duplication)

CONTRIBUTING.md

@@ -121,3 +121,27 @@ Changelog entries to write, index status to update.
 - One entry per discrete change, even if you make several in one day.
 - If a change spans nodes, repeat the entry on each affected page (different perspective is fine).
 - Don't rewrite history — entries are append-only. Mistakes get a follow-up entry that supersedes them.
+
+## Same-session update rule
+
+When you make a change to a node — migrate an LXC, update an IP, change a
+mount, deploy a new service — **update every relevant doc page in the same
+session.** A change that touches a container page must also update:
+
+- The `containers/index.md` table (IPs, host, mounts, status)
+- The `README.md` table (if the change affects listed columns)
+- The Caddy page site list (if the change affects `*.hubris.network` routing)
+- The DNS / ingress infrastructure pages (if the change affects routing)
+- The `hosts/{hubris,strong}.md` host page (if container count changes)
+- The `inventory.yaml` host entry (source of truth for the `hosts/*.yaml` generation)
+- The `infrastructure/topology.md` (generated from inventory, but regen if needed)
+
+The pattern of updating only one page and leaving stale references on others
+is a bug. If you're doing a multi-step migration, document the intermediate
+state with a changelog entry that says "pending — will finalize after Phase
+N."
+
+This rule is why Phase 2 of the strong migration (2026-07-05) caused
+widespread stale data: individual container pages were updated in the
+changelog but never had their At-a-glance sections, IPs, mount paths, or
+host attribution updated. Don't repeat that.