docs: reorganize into design, security, api, ops and dev; drop stale designs; refresh the diagrams [CI]

- Group docs by category with an index (docs/README.md); fix every link,
  code comment and the protocol conformance test that read docs/protocol.md.
- access.md and security.md rewritten to what is implemented: removed the
  unadopted member-proof chain, roles and recovery key that do not exist,
  the old implementation order and the budgets; gaps now carry a status.
- enrollment, deployment, api: the install flow is the static, hash-checked
  script with environment variables; no default admin.
- README and architecture: new topology and update-flow diagrams (operator
  passkey, CI signing, registry feed, auth and trust modules).

packaging/compose/agent/compose.yaml

@@ -1,6 +1,6 @@
 # Docker 和 rootless/rootful Podman 共用。配置、身份和缓存保存在命名 volume 中。
 # docker compose up -d / podman compose up -d（Podman 以普通用户执行即可 rootless）。
-# 首次注册、配置导入和自动更新见 docs/deployment.md。
+# 首次注册、配置导入和自动更新见 docs/ops/deployment.md。
 services:
   agent:
     image: ${MOSHIRO_IMAGE:-registry.oeo.one/moshiro/moshiro-agent}:${MOSHIRO_VERSION:-0.1.1}

packaging/compose/probe/compose.yaml

@@ -1,6 +1,6 @@
 # Docker 和 rootless/rootful Podman 共用。配置、身份和缓存保存在命名 volume 中。
 # docker compose up -d / podman compose up -d（Podman 以普通用户执行即可 rootless）。
-# 首次注册、配置导入和自动更新见 docs/deployment.md。
+# 首次注册、配置导入和自动更新见 docs/ops/deployment.md。
 services:
   probe:
     image: ${MOSHIRO_IMAGE:-registry.oeo.one/moshiro/moshiro-probe}:${MOSHIRO_VERSION:-0.1.1}

packaging/container/deploy-node.sh

@@ -11,7 +11,7 @@
 #
 # Backend 只支持 Podman，更新策略固定为 manual（管理端确认），监听宿主网络的 --port。
 # 需要 root、systemd，以及 Podman 或 Docker；脚本要和 packaging/ 里的 systemd/、update/ 放在一起。
-# rootless Podman 见 docs/deployment.md。
+# rootless Podman 见 docs/ops/deployment.md。
 set -eu
 
 usage() {
@@ -45,7 +45,7 @@ while [ $# -gt 0 ]; do
     *) usage ;;
   esac
 done
-[ "$(id -u)" -eq 0 ] || { echo "run as root (rootless Podman: see docs/deployment.md)" >&2; exit 1; }
+[ "$(id -u)" -eq 0 ] || { echo "run as root (rootless Podman: see docs/ops/deployment.md)" >&2; exit 1; }
 
 HERE="$(cd "$(dirname "$0")" && pwd)"
 PACKAGING="$(cd "$HERE/.." && pwd)"