docs: move the engineering documents into docs/

Thirteen files at the repository root, seven of them documents. Only README.md
earns a place there; the rest are now in docs/ beside the meeting notes, the
client roadmap and the historical material.

The compose files stay. docker-compose.yml is the path the dtf-cloud Portainer
stack reads, so moving it would break deployment, and Docker resolves a compose
file's relative build contexts against its own directory, so moving the other
two would silently break every build. Both reasons are now written down where
someone would otherwise try it.

Correcting references turned up a live fault: the Portainer stack creation
instructions still named deploy/stack.yaml as the compose path. That file was
removed, so anyone recreating the stack from these instructions would have
failed. It names docker-compose.yml now, with the reason it stays at the root.

ROADMAP.md keeps the paths its closed findings were written with, and says so at
the top. Those entries record where a fault was when it was found; rewriting
them to match a later layout would make the record less true, not more.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

app/core/secrets.py

@@ -3,7 +3,7 @@
 Swarm mounts each secret as a file and the stack passes its path as `<NAME>_FILE`.
 The deployed `docker-compose.yml` passes credentials as plain environment
 variables, so this module is inert there. It exists so a stack can supply them as
-Docker secrets instead without any code change; see `ROADMAP.md` 2.12.
+Docker secrets instead without any code change; see `docs/ROADMAP.md` 2.12.
 
 Call `load()` in every entrypoint before any configuration is read.