fix: complete the docs/→design/ and openapi→api/ rename references

The file moves (docs/ → design/, docs/api/openapi.json → api/openapi.json) landed
in d01a8fd, but the matching reference updates did not — so mgmt.rs's drift-test
`include_str!("../../../docs/api/openapi.json")` pointed at a path that no longer
exists and the host failed to build. This restores it and updates every reference:

  - mgmt.rs include_str! → ../../../api/openapi.json (fixes the build)
  - web/orval.config.ts codegen target, web/Dockerfile, .dockerignore
  - deb/rpm/Arch packaging install paths
  - CLAUDE.md, the .gitea CI workflows, code doc-comments, design-doc cross-links

docs-site route URLs (/docs/...) untouched.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

packaging/windows/drivers/pf-vdisplay/src/adapter.rs

@@ -137,7 +137,7 @@ pub(crate) fn adapter() -> Option<iddcx::IDDCX_ADAPTER> {
 /// iGPU+dGPU box the OS may otherwise pick the iGPU to render the virtual monitor, so the host's shared
 /// ring textures (created on the NVENC dGPU) can't be opened → `DRV_STATUS_TEX_FAIL` → the host's 20 s
 /// black bail. Pinning the render adapter to the encode GPU fixes that. Unconditional — NOT the
-/// SudoVDA-parity default-off branch (`docs/windows-host-rewrite.md` §2.8). Returns
+/// SudoVDA-parity default-off branch (`design/windows-host-rewrite.md` §2.8). Returns
 /// `STATUS_NOT_FOUND` if called before the adapter exists.
 pub fn set_render_adapter(luid_low: u32, luid_high: i32) -> NTSTATUS {
     let Some(adapter) = adapter() else {