Fix broken internal docs links

docs/admin-control-plane.md

@@ -32,7 +32,7 @@ Authenticated requests now carry a request-scoped identity with either the `api`
 
 When API-key auth is enabled, admin routes also enforce the `admin:*` scope at the route layer. This is intentionally redundant with admin-key authentication today and gives future RBAC/OIDC integrations a single policy hook to satisfy.
 
-For the production hardening checklist and OIDC/SSO integration plan, see [security-governance.md](security-governance.md).
+For the production hardening checklist and OIDC/SSO integration plan, see [security-governance](/docs/security-governance).
 
 ## Dashboard Setup
 

docs/deployment.md

@@ -58,7 +58,7 @@ The files in `deploy/` provide a production-oriented Compose starting point:
 
 Use separate values for `STACYVM_API_KEY` and `STACYVM_ADMIN_API_KEY` in production. Admin routes live under `/api/v1/admin/*` and should be restricted to operator networks where possible. Replace the example `server.cors_allowed_origins` value with the exact public console/API origins for your deployment; do not expose browser clients with wildcard CORS.
 
-See [admin-control-plane.md](admin-control-plane.md) for admin dashboard setup, quota operations, diagnostics, audit export, and audit retention notes. See [security-governance.md](security-governance.md) for the production admin hardening checklist and OIDC/SSO integration plan. The production config keeps 90 days of admin audit history with `auth.admin_audit_retention: "2160h"` and disables admin fallback with `auth.admin_fallback_enabled: false`.
+See [admin-control-plane](/docs/admin-control-plane) for admin dashboard setup, quota operations, diagnostics, audit export, and audit retention notes. See [security-governance](/docs/security-governance) for the production admin hardening checklist and OIDC/SSO integration plan. The production config keeps 90 days of admin audit history with `auth.admin_audit_retention: "2160h"` and disables admin fallback with `auth.admin_fallback_enabled: false`.
 
 ```bash
 cd deploy
@@ -198,4 +198,4 @@ Firecracker requires Linux/KVM, a kernel image, rootfs images, networking setup,
 
 PRoot requires a real rootfs with the binaries your sandboxes need. Use it for restricted environments where Docker and KVM are unavailable, and validate memory/disk limits against the host because PRoot enforcement is not equivalent to VM isolation.
 
-Use [runtime-conformance.md](runtime-conformance.md) as the signoff checklist for Docker, gVisor, Kata, Firecracker, PRoot, E2B, and custom providers.
+Use [runtime-conformance](/docs/runtime-conformance) as the signoff checklist for Docker, gVisor, Kata, Firecracker, PRoot, E2B, and custom providers.

docs/production-readiness.md

@@ -93,7 +93,7 @@ This checklist tracks the Phase 7 release-candidate hardening work needed before
 - Support bundle export exists and redacts secrets.
 - Threat model is reviewed for each release candidate.
 - Known limitations are visible in README, docs, and release notes.
-- Public support expectations are documented in [public-support-matrix.md](public-support-matrix.md).
+- Public support expectations are documented in [public-support-matrix](/docs/public-support-matrix).
 - Bug and production support issue templates ask for the same evidence required by the public support matrix.
 - Public release sanity CI builds release binaries and validates checksums; real GitHub release asset verification must be repeated after each version tag is published.
 - Public browser clients use explicit CORS origins; wildcard CORS must fail `stacyvm config lint --production`.
@@ -108,7 +108,7 @@ This checklist tracks the Phase 7 release-candidate hardening work needed before
 - Distributed leases to prevent double ownership. Done in Phase 10.
 - OIDC/SSO and RBAC implemented. RS256 JWT Bearer token validation with configurable OIDC issuer, JWKS URL, audience, and group-to-role mapping is implemented. Roles: `viewer`, `operator`, `admin`, `tenant_admin`, `worker`. Done in Phase 14.
 - Tenant/project model implemented. Tenants, tenant members with RBAC roles, policy controls (image/provider/network allow-deny lists), per-tenant audit export, and admin UI management are implemented. Done in Phase 14.
-- Worker RPC transport enforces [worker-rpc-contract.md](worker-rpc-contract.md). Done in Phase 11-13.
+- Worker RPC transport enforces [worker-rpc-contract](/docs/worker-rpc-contract). Done in Phase 11-13.
 
 ## Phase 14 Acceptance Criteria
 

docs/public-support-matrix.md

@@ -56,13 +56,13 @@ GitHub bug and production support issue templates ask for this same evidence. Re
 
 | Symptom | First remediation path |
 |---|---|
-| Install verification fails | [releasing.md](releasing.md) |
-| Production config lint fails | [deployment.md](deployment.md) |
-| Upgrade rehearsal fails | [deployment.md#upgrade-rehearsal-and-rollback](deployment.md#upgrade-rehearsal-and-rollback) |
-| Runtime health fails | [runtime-certification.md](runtime-certification.md) |
-| Runtime behavior differs across providers | [runtime-conformance.md](runtime-conformance.md) |
-| Admin or auth hardening question | [security-governance.md](security-governance.md) |
-| Operator diagnostics needed | [deployment.md#support-bundles](deployment.md#support-bundles) |
+| Install verification fails | [releasing](/docs/releasing) |
+| Production config lint fails | [deployment](/docs/deployment) |
+| Upgrade rehearsal fails | [deployment#upgrades](/docs/deployment#upgrades) |
+| Runtime health fails | [runtime-certification](/docs/runtime-certification) |
+| Runtime behavior differs across providers | [runtime-conformance](/docs/runtime-conformance) |
+| Admin or auth hardening question | [security-governance](/docs/security-governance) |
+| Operator diagnostics needed | [deployment#support-bundles](/docs/deployment#support-bundles) |
 
 ## Post-Tag Release Verification
 

docs/rest-api.md

@@ -9,7 +9,7 @@ This document is the source of truth for the StacyVM HTTP API. The Python and Ty
 
 - **Base URL:** `http://localhost:7423/api/v1`
 - **Content type:** `application/json` (request and response, except where noted)
-- **OpenAPI spec:** [swagger.yaml](swagger.yaml) / [swagger.json](swagger.json)
+- **OpenAPI spec:** [swagger.yaml](https://github.com/StacyOS/stacyvm/blob/main/docs/swagger.yaml) / [swagger.json](https://github.com/StacyOS/stacyvm/blob/main/docs/swagger.json)
 
 ---
 
@@ -128,7 +128,7 @@ auth:
 
 Use `X-Admin-API-Key` for admin requests. `X-API-Key` is still accepted when it matches the admin key. If `auth.admin_api_key` is empty, admin routes fall back to `auth.api_key` for backwards compatibility unless `auth.admin_fallback_enabled` is set to `false`.
 
-For dashboard setup, quota workflows, diagnostics, audit history, CSV export, and storage notes, see [admin-control-plane.md](admin-control-plane.md).
+For dashboard setup, quota workflows, diagnostics, audit history, CSV export, and storage notes, see [admin-control-plane](/docs/admin-control-plane).
 
 Admin route aliases:
 
@@ -1203,7 +1203,7 @@ Upgrades the connection to a WebSocket for interactive command execution. Useful
 { "type": "exit",   "exit_code": 0 }
 ```
 
-The web dashboard uses this endpoint to power its live terminal — a concrete reference is at [`web/src/`](../web/src/).
+The web dashboard uses this endpoint to power its live terminal — a concrete reference is at [`web/src/`](https://github.com/StacyOS/stacyvm/tree/main/web/src).
 
 ---
 
@@ -1222,4 +1222,4 @@ If you'd rather write Python or TypeScript than `curl`, every endpoint above map
 | `GET /pool/status` | `client.pool_status()` | `client.poolStatus()` |
 | `GET /health` | `client.health()` | `client.health()` |
 
-Full SDK docs: [Python](../sdk/python/README.md) · [TypeScript](../sdk/js/README.md).
+Full SDK docs: [Python](/docs/sdks/python) · [TypeScript](/docs/sdks/typescript).

docs/worker-rpc-contract.md

@@ -242,4 +242,4 @@ In Postgres terms, lease acquire should be implemented with a unique key on `res
 
 ## Current Limits
 
-Remote placement returns `remote_worker_rpc_unavailable` unless the selected worker advertises `rpc_url` and the control plane can authenticate to worker RPC with either short-lived signed RPC-audience tokens or a static worker token. Postgres-backed cluster storage and signed production worker identity are wired into the current transport; deployment certification still needs the target host/runtime conformance checks listed in [cluster-conformance.md](cluster-conformance.md).
+Remote placement returns `remote_worker_rpc_unavailable` unless the selected worker advertises `rpc_url` and the control plane can authenticate to worker RPC with either short-lived signed RPC-audience tokens or a static worker token. Postgres-backed cluster storage and signed production worker identity are wired into the current transport; deployment certification still needs the target host/runtime conformance checks listed in [cluster-conformance](/docs/cluster-conformance).