docs: reprendre les citations après le rangement, et retirer le membre login fabriqué

Les deux contrats et la doctrine portent des centaines de citations `file:line`
vers `src/`. Le rangement par destin les périmait en bloc — 208 reprises (45
chemins `src/x.ts`, 163 mentions nues). Sans ça la réorganisation pourrissait
l'instrument même qui tient la discipline qu'elle sert.

Et un défaut relevé par le contrat interne, vérifié : `ng-proxy` fabriquait un
membre `login`. `@ng-org/web` n'expose aucune méthode de ce nom — zéro
occurrence dans les déclarations installées comme dans `sdk/js/lib-wasm/src/lib.rs`
— mais le proxy répondait une fonction au lieu d'`undefined`, laquelle plantait
à l'appel. C'était le seul endroit où ce wrapper ajoutait à la surface du SDK,
contre son propre en-tête.

157 tests unitaires, typecheck src/test/e2e vert.

docs/decisions/discovery-model.md

@@ -23,7 +23,7 @@
 
 **Date:** 2026-06-16 · **Status:** SUPERSEDED 2026-07-30 (see the block above). *Originally: mechanism accepted; target owner undecided.*
 Ported here for the discovery mechanism it defines — the piece this lib
-realizes (`inbox.ts` post/materialize/watch; `store-registry.ts` fan-out). The
+realizes (`inbox.ts` post/materialize/watch; `shared-wallet/account-registry.ts` fan-out). The
 product intent (what a consumer application *should* surface) is the consumer
 application's concern, not this lib's; only the mechanism is recorded here.
 
@@ -84,7 +84,7 @@ later. This is why a global-index package is a deferred separate package in this
 ## Polyfill reality — the fan-out drift is now RESOLVED (special-account index)
 
 The shared-wallet polyfill originally shipped a cross-account fan-out over
-every account's public documents (`store-registry.ts` `listEntityDocs('public')`
+every account's public documents (`shared-wallet/account-registry.ts` `listEntityDocs('public')`
 / `resolveReadGraphs`) — one account saw another's public entity without any
 relationship to its creator. This ADR classified that per-account fan-out as a drift
 to be replaced by the single global index.

docs/decisions/private-store-nuri-scope.md

@@ -47,7 +47,7 @@ breaks writes with `RepoNotFound`). See the scope rule in
 
 *The decision stands; the mechanism named in it has been replaced.* Opening was
 `orm_start_graph` when this was written. It is now `ensureRepoOpen` — `doc_subscribe`
-plus a wait for the first `State` (`packages/client/src/open-repo.ts:167`) — after
+plus a wait for the first `State` (`packages/client/src/emulated-verifier/open-repo.ts:167`) — after
 `orm_start_graph` was found to hang on a fan-out (`subscribe.ts:28,181`). What must be
 read here is the invariant *"open the repo, by its store NURI, before writing"*, not the
 call that used to implement it.

docs/decisions/shared-wallet-login-flow.md

@@ -2,7 +2,7 @@
 
 **Date:** 2026-06-15 · **Status:** Accepted (frozen). The rationale behind how
 the consumer application presents identity selection as a perceived login, and why
-the lib's identity store (`accounts.ts`) must never touch NextGraph. The lib itself
+the lib's identity store (`shared-wallet/accounts.ts`) must never touch NextGraph. The lib itself
 no longer frames this as a login: it receives an identity id, set at wallet-import
 time; the perceived-login UX lives entirely in the consumer application.
 
@@ -63,7 +63,7 @@ barrier becomes the real per-user login — the flow shape does not change.
 
 ## How this lib realizes it
 
-`accounts.ts` is an `IdentityStore`: `set(id)` / `clear()` / `get()` only read/write
+`shared-wallet/accounts.ts` is an `IdentityStore`: `set(id)` / `clear()` / `get()` only read/write
 the identity id in an injected `AccountStorage`; they never call NG. The id is set at
 wallet-import time and relayed via the lib's current-identity call; the perceived
 login is the consumer application's. See the identity store in