docs: organize docs into project subdirectories

Split docs/ into project-based subdirectories:
- docs/proxmox/     fleet ops, hardware, k8s (PROJECT.md, TODO.md, K8S.md)
- docs/server-build/ provisioning, security, DNS (SECURITY.md, tailscale.md,
                    DEPLOYMENT.md, TSYS-2FA-GUIDE.md, DEVELOPMENT-GUIDELINES.md)
- docs/archive/     historical AI reviews, completed todos, pre-refactor docs

docmap.md rewritten with new paths. All cross-references in AGENTS.md,
README.md, STATUS.md, and dns-cluster-setup/README.md updated.

Code directories unchanged — scripts stay where BASH_SOURCE expects them.

🤖 Generated with [Crush](https://github.com/charmassociates/crush)

Assisted-by: GLM-5 via Crush <crush@charm.land>

AGENTS.md

@@ -72,4 +72,4 @@ vendor/              Vendored KNELShellFramework
 Solo-founder R&D Proxmox cluster in a private residence. Shoestring budget.
 Production lives on a Cloudron VPS in Reston VA. See
 [`STATUS.md`](STATUS.md) for current state and
-[`docs/PROJECT.md`](docs/PROJECT.md) for the fleet report.
+[`docs/proxmox/PROJECT.md`](docs/proxmox/PROJECT.md) for the fleet report.

dns-cluster-setup/README.md

@@ -179,5 +179,5 @@ dig @192.168.3.253 pfv-netinfra-01.knel.net
 
 The KNELServerBuild provisioning code (`provisioning/ConfigFiles/NTP/ntp.conf`
 and `provisioning/ConfigFiles/Resolv/resolv.conf`) points clients at both
-servers for DNS and NTP redundancy. See `docs/tailscale.md` for the
+servers for DNS and NTP redundancy. See `docs/server-build/tailscale.md` for the
 full DNS architecture analysis.

docs/docmap.md

@@ -5,20 +5,27 @@
 
 > **Last updated:** 2026-07-28
 
-## Active Documentation
+## Proxmox Cluster ([`proxmox/`](proxmox/))
 
-These docs reflect current reality and should be kept up to date.
+Fleet operations, hardware, performance tuning, storage architecture.
 
 | Document | Description | Last Reviewed |
 |----------|-------------|---------------|
-| [`PROJECT.md`](PROJECT.md) | Comprehensive fleet report: 7 Proxmox hosts, VM inventory, storage architecture, recommendations | 2026-07-27 |
+| [`proxmox/PROJECT.md`](proxmox/PROJECT.md) | Comprehensive fleet report: 7 hosts, VM inventory, storage, recommendations | 2026-07-27 |
-| [`SECURITY.md`](SECURITY.md) | Security architecture: SSH hardening, 2FA, SCAP-STIG, Wazuh, auditd | 2026-07-25 |
+| [`proxmox/TODO.md`](proxmox/TODO.md) | Pending physical hardware work (tsys2/4/5 Friday plan) | 2026-07-27 |
-| [`tailscale.md`](tailscale.md) | Tailscale vs managed DNS analysis (RESOLVED — netinfra pair serves knel.net) | 2026-07-28 |
+| [`proxmox/K8S.md`](proxmox/K8S.md) | Kubernetes architecture deep-dive (for future k8s session) | 2026-07-27 |
-| [`DEPLOYMENT.md`](DEPLOYMENT.md) | Server deployment procedures, package lists, config flow | 2026-07-25 |
+
-| [`TODO.md`](TODO.md) | Pending physical hardware work (tsys2/4/5 Friday plan) | 2026-07-27 |
+## Server Build ([`server-build/`](server-build/))
-| [`K8S.md`](K8S.md) | Kubernetes architecture deep-dive (for future k8s session) | 2026-07-27 |
+
-| [`TSYS-2FA-GUIDE.md`](TSYS-2FA-GUIDE.md) | End-user guide for 2FA setup (SSH, Cockpit, Webmin) | 2026-07-25 |
+Server provisioning, security hardening, DNS/NTP configuration.
-| [`DEVELOPMENT-GUIDELINES.md`](DEVELOPMENT-GUIDELINES.md) | Coding standards, commit conventions, script patterns | 2026-07-25 |
+
+| Document | Description | Last Reviewed |
+|----------|-------------|---------------|
+| [`server-build/SECURITY.md`](server-build/SECURITY.md) | Security architecture: SSH hardening, 2FA, SCAP-STIG, Wazuh, auditd | 2026-07-25 |
+| [`server-build/tailscale.md`](server-build/tailscale.md) | Tailscale vs managed DNS analysis (RESOLVED — netinfra pair serves knel.net) | 2026-07-28 |
+| [`server-build/DEPLOYMENT.md`](server-build/DEPLOYMENT.md) | Server deployment procedures, package lists, config flow | 2026-07-25 |
+| [`server-build/TSYS-2FA-GUIDE.md`](server-build/TSYS-2FA-GUIDE.md) | End-user guide for 2FA setup (SSH, Cockpit, Webmin) | 2026-07-25 |
+| [`server-build/DEVELOPMENT-GUIDELINES.md`](server-build/DEVELOPMENT-GUIDELINES.md) | Coding standards, commit conventions, script patterns | 2026-07-25 |
 
 ## Operational Guides (outside docs/)
 
@@ -29,28 +36,28 @@ These docs reflect current reality and should be kept up to date.
 | [`../netinfra/pfv-netinfra-setup.md`](../netinfra/pfv-netinfra-setup.md) | pfv-netinfra-01/02 initial setup guide | 2026-07-27 |
 | [`../netinfra/pfv-netboot-setup.md`](../netinfra/pfv-netboot-setup.md) | pfv-netboot reference node setup | 2026-07-27 |
 
-## Historical / Reference (read-only context)
+## Archive ([`archive/`](archive/))
 
-These docs are preserved for historical context. They may reference pre-merge
+Historical AI reviews, completed task lists, and pre-refactor examples. Read-only
-paths or outdated architecture. Do not update them; link to active docs instead.
+context — do not update; link to active docs instead.
 
 | Document | Description |
 |----------|-------------|
-| [`CODE-REVIEW-FINDINGS.md`](CODE-REVIEW-FINDINGS.md) | Early code review findings (most issues now fixed) |
+| [`archive/CODE-REVIEW-FINDINGS.md`](archive/CODE-REVIEW-FINDINGS.md) | Early code review findings (most issues now fixed) |
-| [`REFACTORING-EXAMPLES.md`](REFACTORING-EXAMPLES.md) | Pre-refactor code patterns (historical "before" examples) |
+| [`archive/REFACTORING-EXAMPLES.md`](archive/REFACTORING-EXAMPLES.md) | Pre-refactor code patterns (historical "before" examples) |
-| [`Claude-Review.md`](Claude-Review.md) | Claude's initial code review |
+| [`archive/Claude-Review.md`](archive/Claude-Review.md) | Claude's initial code review |
-| [`AIReview-QWEN.md`](AIReview-QWEN.md) | Qwen AI review |
+| [`archive/AIReview-QWEN.md`](archive/AIReview-QWEN.md) | Qwen AI review |
-| [`AiOverview-Gemini.md`](AiOverview-Gemini.md) | Gemini project overview |
+| [`archive/AiOverview-Gemini.md`](archive/AiOverview-Gemini.md) | Gemini project overview |
-| [`AiOverview-OpenCode.md`](AiOverview-OpenCode.md) | OpenCode project overview |
+| [`archive/AiOverview-OpenCode.md`](archive/AiOverview-OpenCode.md) | OpenCode project overview |
-| [`AiSecurityAudit-Gemini.md`](AiSecurityAudit-Gemini.md) | Gemini security audit |
+| [`archive/AiSecurityAudit-Gemini.md`](archive/AiSecurityAudit-Gemini.md) | Gemini security audit |
-| [`charles-todo.md`](charles-todo.md) | Charles's early task list (completed) |
+| [`archive/charles-todo.md`](archive/charles-todo.md) | Charles's early task list (completed) |
-| [`claude-todo.md`](claude-todo.md) | Claude's early task list (completed) |
+| [`archive/claude-todo.md`](archive/claude-todo.md) | Claude's early task list (completed) |
 
 ## Top-Level Files
 
 | File | Description |
 |------|-------------|
-| [`../AGENTS.md`](../AGENTS.md) | Agent operating instructions (repo layout, git policy, key scripts) |
+| [`../AGENTS.md`](../AGENTS.md) | Agent operating instructions (repo layout, git policy, gardening protocol) |
 | [`../STATUS.md`](../STATUS.md) | Living project status (agent-maintained, human read-only) |
 | [`../README.md`](../README.md) | Project overview and quick start |
 | [`../LICENSE`](../LICENSE) | License |
@@ -68,7 +75,7 @@ When making changes to this repo, agents MUST:
 3. **Verify cross-references** — any new `.md` file must be linked from at
    least one existing doc or this map.
 4. **Check for stale paths** — after any directory rename or file move,
-   grep all `.md` files for old paths and fix them.
+   `grep -rn 'old/path' --include='*.md'` and fix all references.
 5. **Keep code and docs in sync** — if you change a script's interface,
    behavior, or location, update every doc that references it in the same
    commit.