docs: publish the generic ChurchTools reference as a Handbuch section (#89)

[2000game]

Closes #89.

docs/ was mixing two audiences. This splits them by location, so the publishing rule is mechanical rather than a judgement call: a page publishes only if it lives under docs/handbuch/ and is reachable from that section's own mkdocs.yml nav.

What moved

Published (docs/handbuch/)	Stays unpublished (docs/)
permissions.md, dynamic-groups.md, field-definitions.md, blueprints.md	api-coverage.md, group-field-decisions.md, runbook-manual-surface.md, superpowers/

docs/churchtools-reference/ from the issue's scope does not exist in this repo — nothing to move.

What was added

• docs/handbuch/mkdocs.yml — mini section config, same shape as the connector's Betrieb section (docs_dir: ., strict: true, exclude_docs: mkdocs.yml), ready for the !include in eqrm/churchtools-connector#1115.
• docs/handbuch/index.md — section overview, plus a table locating the three documentation layers (generic CT behaviour here / instance structure in ct-structure / connector how-tos in the Handbuch).
• docs/handbuch/requirements.txt — pinned in lockstep with the connector's requirements-docs.txt, so the section renders identically here and in the consuming site.
• docs/README.md — states the published-vs-unpublished rule and how to re-sign a page.
• .github/workflows/docs.yml — two gates: the strict mkdocs build, and the reusable estate-wide staleness checker (eqrm/churchtools-connector/.github/workflows/docs-staleness.yml@main, docs-path: docs/handbuch, secrets: inherit).

Staleness bindings

Each page declares the code it documents and signs it:

Page	sources:
permissions.md	src/permissions/**, src/resolve/resolver.ts, src/resolve/refs.ts, src/config/context.ts
dynamic-groups.md	src/config/query.ts, src/config/query-refs.ts, src/engine/dynamic.ts, src/engine/synthetic.ts, src/commands/adopt-group.ts
field-definitions.md	src/commands/get.ts, src/api/ctClient.ts
blueprints.md	src/config/context.ts, src/engine/graph.ts, src/engine/hierarchy.ts

index.md carries sources: [] + an exempt reason (links and framing only).

All four sources_hash values were computed here and then cross-checked against the canonical PHP implementation (App\Services\Docs\SourcesHasher run against this checkout) — identical, including file counts.

Verification

• mkdocs build -f docs/handbuch/mkdocs.yml --strict → clean. Getting there meant absolutizing links that leave the section (../src/..., ../examples/..., the unpublished group-field-decisions.md) to https://github.com/eqrm/ct-cli/blob/main/..., so the pages read correctly both on GitHub and in the built site.
• Every referrer of a moved page updated: src/** comments, examples/**, tests/**, README.md, sibling docs/**. docs/superpowers/plans/ is deliberately untouched — those are historical records of what was done at the time.
• npm run lint, npm run typecheck, npm test (570 passed, 5 skipped) → green.
• site/ added to .gitignore.

Known, deliberate

Language mismatch: these pages land in the German Handbuch while being English. Per the issue, they are placed now and flagged — index.md carries an admonition pointing at #89, and the section config sets language: en so search and UI chrome at least match the page text while the mismatch stands. The follow-on content epic decides translate vs. move to Betrieb.

First CI run caveat: the staleness job needs the org-level APP_ID / APP_PRIVATE_KEY to be visible to this repo (that is what secrets: inherit passes through). If they are not, that job fails on create-github-app-token with "Input required and not supplied" — a repo-settings fix, not a code one.

https://claude.ai/code/session_01KPxjSEkqMiU7WE3vg6C3am