docs(user): restructure user docs into topic sections (Phase 1) (#223)

Move the 23 flat docs/user/*.md files into topic subdirectories so the
user guide is organized by area (schema, queries, search, branching, cli,
operations, clusters, concepts, reference) instead of a flat list. This is
a pure structural move — whole files relocated, every cross-doc link
recomputed, no prose rewrites or content splits (those follow in Phase 2).

- 19 `git mv`s (install.md, deployment.md stay top-level); history preserved
  (renames detected at 92–100% similarity).
- All intra-doc links, AGENTS.md's topic table (52 pointers), and the
  docs/dev + docs/releases back-links recomputed via relpath from each
  file's new location.
- docs/user/index.md rewritten as a sectioned nav hub.
- Fixed 5 doc-path references in Rust (comments + two user-facing server
  settings error strings) to point at the new locations.

Verified: zero broken .md links across tracked docs; check-agents-md.sh
green (with the untracked scratch docs set aside); touched crates build.

Note: the public site (omnigraph-web) imports docs/ via a flat-only script;
its import-docs.mjs needs a subdir-aware update before the next re-sync.

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

crates/omnigraph-cli/src/cli.rs

@@ -26,7 +26,7 @@ pub(crate) struct Cli {
     /// Actor id for direct-engine writes; overrides `cli.actor`. No effect on
     /// remote writes (the server resolves the actor from the bearer token).
     /// With a policy configured but no actor set, the write is denied — see
-    /// docs/user/policy.md.
+    /// docs/user/operations/policy.md.
     #[arg(long = "as", global = true, value_name = "ACTOR")]
     pub(crate) as_actor: Option<String>,
 

crates/omnigraph-server/src/settings.rs

@@ -327,14 +327,14 @@ pub fn classify_server_runtime_state(
             "server has no bearer tokens and no policy file configured. This is a fully \
              open server — pass `--unauthenticated` (or set OMNIGRAPH_UNAUTHENTICATED=1) \
              if you actually want that, otherwise configure bearer tokens (see \
-             docs/user/server.md) and/or `policy.file` in omnigraph.yaml."
+             docs/user/operations/server.md) and/or `policy.file` in omnigraph.yaml."
         ),
         (false, false, true) => Ok(ServerRuntimeState::Open),
         (true, false, _) => Ok(ServerRuntimeState::DefaultDeny),
         (false, true, _) => bail!(
             "policy file is configured but no bearer tokens — every request would 401 \
              because no token can ever match. Configure at least one bearer token (see \
-             docs/user/server.md), or remove the policy file. To deny all unauthenticated \
+             docs/user/operations/server.md), or remove the policy file. To deny all unauthenticated \
              traffic deliberately, configure tokens plus a deny-all Cedar rule — that \
              produces meaningful 403s with policy-decision logging instead of silent 401s."
         ),

crates/omnigraph/src/exec/query.rs

@@ -763,7 +763,7 @@ fn traversal_indexed_override() -> Option<bool> {
 
 /// Max source-row frontier for which Expand uses the BTREE-indexed path.
 /// Larger frontiers fall back to the in-memory CSR (dense / whole-graph). See
-/// `docs/user/constants.md`.
+/// `docs/user/reference/constants.md`.
 const DEFAULT_EXPAND_INDEXED_MAX_FRONTIER: usize = 1024;
 /// Max hop count for the indexed path (each hop is one indexed scan; very deep
 /// traversals fan out toward whole-graph and are better served by CSR).

crates/omnigraph/tests/ordering.rs

@@ -7,7 +7,7 @@
 //! keys yield a TOTAL, deterministic order (and `ORDER … LIMIT` is
 //! deterministic). NULL placement is `nulls_first = !descending` (NULLs first
 //! under ASC, last under DESC). Both are documented in
-//! `docs/user/query-language.md`.
+//! `docs/user/queries/index.md`.
 
 mod helpers;