docs: reorganize into design, security, api, ops and dev; drop stale designs; refresh the diagrams [CI]

- Group docs by category with an index (docs/README.md); fix every link,
  code comment and the protocol conformance test that read docs/protocol.md.
- access.md and security.md rewritten to what is implemented: removed the
  unadopted member-proof chain, roles and recovery key that do not exist,
  the old implementation order and the budgets; gaps now carry a status.
- enrollment, deployment, api: the install flow is the static, hash-checked
  script with environment variables; no default admin.
- README and architecture: new topology and update-flow diagrams (operator
  passkey, CI signing, registry feed, auth and trust modules).

scripts/smoke-wsl.py

@@ -3,7 +3,7 @@
 前提：WSL 里有 Debian（root）、tc（netem 注入丢包/延迟/黑洞用）；已经用 scripts/publish.sh 发布了 linux-x64 的 agent、backend、fleet-enroll，
 并且 Windows 上发布了 probe（dotnet publish backend/probe/src/MoShiro.Probe -c Release -r win-x64 -p:PublishAot=true -o backend/artifacts/aot-probe）。
 把 linux-x64 的产物复制到 WSL 的 /root/mon/，在 WSL 里用 setsid -f nohup 启动 moshiro-backend（监听 0.0.0.0:29181），再运行本脚本。
-故障注入见 docs/deployment.md 第 3 节。
+故障注入见 docs/ops/deployment.md 第 3 节。
 """
 import json, os, subprocess, sys, time, urllib.request, urllib.error