docs: reorganize into design, security, api, ops and dev; drop stale designs; refresh the diagrams [CI]

- Group docs by category with an index (docs/README.md); fix every link,
  code comment and the protocol conformance test that read docs/protocol.md.
- access.md and security.md rewritten to what is implemented: removed the
  unadopted member-proof chain, roles and recovery key that do not exist,
  the old implementation order and the budgets; gaps now carry a status.
- enrollment, deployment, api: the install flow is the static, hash-checked
  script with environment variables; no default admin.
- README and architecture: new topology and update-flow diagrams (operator
  passkey, CI signing, registry feed, auth and trust modules).

backend/tests/MoShiro.Backend.Tests/ArchitectureTests.cs

@@ -3,7 +3,7 @@ using System.Xml.Linq;
 namespace MoShiro.Backend.Tests;
 
 /// <summary>
-/// 依赖规则（docs/project-layout.md 第 3 节）：由测试在构建期强制。
+/// 依赖规则（docs/dev/project-layout.md 第 3 节）：由测试在构建期强制。
 /// 读取仓库里所有 .csproj 和源文件，违反规则就失败。
 /// </summary>
 public sealed class ArchitectureTests

backend/tests/MoShiro.Backend.Tests/CapabilityTests.cs

@@ -8,7 +8,7 @@ using MoShiro.Backend.Application;
 
 namespace MoShiro.Backend.Tests;
 
-/// <summary>能力模型（docs/access.md 第 2 节）：每个管理端点声明能力；密钥只能拿到自己拥有能力的子集；写蕴含读。</summary>
+/// <summary>能力模型（docs/security/access.md 第 3 节）：每个管理端点声明能力；密钥只能拿到自己拥有能力的子集；写蕴含读。</summary>
 [Collection("probe-e2e")]
 public sealed class CapabilityTests
 {

backend/tests/MoShiro.Backend.Tests/OpenApiConformanceTests.cs

@@ -4,7 +4,7 @@ using System.Text.RegularExpressions;
 namespace MoShiro.Backend.Tests;
 
 /// <summary>
-/// 对照 docs/api-guidelines.md 检查运行时生成的 OpenAPI 文档：operationId、路径风格、错误响应格式、字段命名。
+/// 对照 docs/api/api-guidelines.md 检查运行时生成的 OpenAPI 文档：operationId、路径风格、错误响应格式、字段命名。
 /// 新增端点违反规范时，这里会直接失败（等价于文档里的 <c>eng/check-openapi</c>）。
 /// </summary>
 [Collection("backend")]

backend/tests/MoShiro.Backend.Tests/PasskeyTests.cs

@@ -85,7 +85,7 @@ public sealed class SoftwarePasskey : IDisposable
     private static byte[] Text(string text) => [.. Head(3, Encoding.UTF8.GetByteCount(text)), .. Encoding.UTF8.GetBytes(text)];
 }
 
-/// <summary>passkey 登录：注册、登录、拒绝各种错误的断言、只能管理自己的 passkey。设计见 docs/access.md 第 3 节。</summary>
+/// <summary>passkey 登录：注册、登录、拒绝各种错误的断言、只能管理自己的 passkey。设计见 docs/security/access.md 第 4 节。</summary>
 [Collection("probe-e2e")]
 public sealed class PasskeyTests
 {

backend/tests/MoShiro.Backend.Tests/ProtocolDeclarationTests.cs

@@ -39,7 +39,7 @@ public sealed class ProtocolDeclarationTests
     public void EveryDeclaredMethod_IsDocumented()
     {
         string root = FindRoot();
-        string docs = File.ReadAllText(Path.Combine(root, "docs", "protocol.md")) + File.ReadAllText(Path.Combine(root, "backend", "fleet", "README.md"));
+        string docs = File.ReadAllText(Path.Combine(root, "docs", "design", "protocol.md")) + File.ReadAllText(Path.Combine(root, "backend", "fleet", "README.md"));
         string[] missing = [.. s_table.Methods.Select(m => m.Name).Distinct().Where(n => !docs.Contains($"`{n}`", StringComparison.Ordinal))];
         Assert.Empty(missing);
     }
@@ -84,7 +84,7 @@ public sealed class ProtocolDeclarationTests
     private static string FindRoot()
     {
         string? dir = AppContext.BaseDirectory;
-        while (dir is not null && !File.Exists(Path.Combine(dir, "docs", "protocol.md")))
+        while (dir is not null && !File.Exists(Path.Combine(dir, "docs", "design", "protocol.md")))
         {
             dir = Path.GetDirectoryName(dir);
         }

backend/tests/MoShiro.Backend.Tests/QueryPlanningTests.cs

@@ -6,7 +6,7 @@ using MoShiro.Protocol;
 
 namespace MoShiro.Backend.Tests;
 
-/// <summary>时间段、步长与数据源的规划：与 docs/query.md 里的表格逐行对应。</summary>
+/// <summary>时间段、步长与数据源的规划：与 docs/design/query.md 里的表格逐行对应。</summary>
 public sealed class QueryPlanningTests
 {
     private const long Second = 1000;

backend/tests/MoShiro.Backend.Tests/TrustTests.cs

@@ -15,7 +15,7 @@ namespace MoShiro.Backend.Tests;
 
 /// <summary>
 /// 信任根：操作员（passkey）签操作员集合；安装命令里带着创世指纹和属主（都是公开值），节点注册时验证面板的集合并固定在本地。
-/// 设计见 docs/access.md 第 7 节。
+/// 设计见 docs/security/access.md 第 8 节。
 /// </summary>
 [Collection("probe-e2e")]
 public sealed class TrustTests