docs: reprendre les citations après le rangement, et retirer le membre login fabriqué

Les deux contrats et la doctrine portent des centaines de citations `file:line`
vers `src/`. Le rangement par destin les périmait en bloc — 208 reprises (45
chemins `src/x.ts`, 163 mentions nues). Sans ça la réorganisation pourrissait
l'instrument même qui tient la discipline qu'elle sert.

Et un défaut relevé par le contrat interne, vérifié : `ng-proxy` fabriquait un
membre `login`. `@ng-org/web` n'expose aucune méthode de ce nom — zéro
occurrence dans les déclarations installées comme dans `sdk/js/lib-wasm/src/lib.rs`
— mais le proxy répondait une fonction au lieu d'`undefined`, laquelle plantait
à l'appel. C'était le seul endroit où ce wrapper ajoutait à la surface du SDK,
contre son propre en-tête.

157 tests unitaires, typecheck src/test/e2e vert.

docs/migration-guide.md

@@ -18,7 +18,7 @@ The shape is already the target's (P1a): a `ReadCap` is the document's key, a
 each identity holds a set of caps, and there is no read-ACL anywhere. So
 this step swaps the *emulated* key for the real one, not the model:
 
-- `caps.ts`'s per-identity record becomes the verifier's own local user storage —
+- `emulated-verifier/caps.ts`'s per-identity record becomes the verifier's own local user storage —
   it was always the cache, not the register. The two durable registers we emulate
   (`readCap` on the store's Store branch, `link` on its User branch) become the real
   `AddRepo` / `AddLink` commits. Remove the emulation; the wallet and the branches
@@ -32,10 +32,10 @@ this step swaps the *emulated* key for the real one, not the model:
   recipient's own verifier applying queued messages. **The consumer's call does not
   change.**
 - `publishRepoLink` becomes `RepoLinkV0`.
-- The read filter (`read-filter.ts`) and the possession gate in
+- The read filter (`emulated-verifier/read-filter.ts`) and the possession gate in
   `read-model.readUnion` are then dead code — the broker only delivers documents
   whose cap the wallet holds. Remove them.
-- The write guard (`ng-proxy.ts` `sparql_update` override) is a separate axis and
+- The write guard (`surface/ng-proxy.ts` `sparql_update` override) is a separate axis and
   is decorative today (every internal writer bypasses the proxy); it belongs to the
   P1b batch, not here.
 
@@ -56,7 +56,7 @@ in the shim (see the two-axes section in [`simulation.md`](./simulation.md)).
   `getNativeStore(scope)`-style resolver returning the real store to pass as the
   `docCreate` destination, so the logical scope label becomes a real store
   placement. (No such helper exists yet — it is blocked on the SDK gap above.)
-- At that point `store-registry.ts` maps `(account, scope)` to the user's real
+- At that point `shared-wallet/account-registry.ts` maps `(account, scope)` to the user's real
   store NURI instead of a document in the shared wallet; the per-scope index
   document (the store-container emulation) is replaced by the store itself. The
   surface facing the consumer application (`createEntityDoc`, `listMyEntityDocs`,
@@ -67,7 +67,7 @@ The `sharedWalletShim` (account → 3 scope-document NURIs, held in a subscribab
 doc-shim reached via a write-once pointer in the store-root — see
 [`nextgraph-current-state.md`](./nextgraph-current-state.md) § *The pointer → doc-shim
 indirection*) has no target equivalent — the target has no central directory. Remove
-it entirely: `store-registry.ts`, `configureStoreRegistry`, the pointer + doc-shim
+it entirely: `shared-wallet/account-registry.ts`, `configureStoreRegistry`, the pointer + doc-shim
 resolution, and the `pointerGuard` dep. Cross-wallet reads replace the fan-out;
 per-user wallets replace the shared one.
 
@@ -79,7 +79,7 @@ when it processes its inbox — there is no separate curator to build; the in-li
 emulation simply goes away. *(There is no global index to replace the cross-account fan-out: both were removed on 2026-07-30 — you cannot discover in NextGraph, you follow links.)*
 
 ### 5. Retire the identity store → real per-user login
-Remove `accounts.ts` (the `IdentityStore` that persists the identity id in
+Remove `shared-wallet/accounts.ts` (the `IdentityStore` that persists the identity id in
 `localStorage`) and the app-level "Connexion" screen. The technical broker gate
 becomes the real per-user login
 (see [`decisions/shared-wallet-login-flow.md`](./decisions/shared-wallet-login-flow.md)).