Enforce unique doc filenames and simple wiki-links (#109)

## Summary
- Rename section index files to match their titles (tutorials.md, reference.md, how-to.md, explanation.md) so all filenames are unique
- Convert all ~47 path-based wiki-links to simple filename format across 15 files
- Update doc-filenames task to no longer skip index.md files
- Update doc-links task to reject path-based links containing '/'

This ensures all wiki-links work correctly in obsidian.nvim by making links resolvable by filename alone.

## Testing
- `mise run doc-filenames` - all unique
- `mise run doc-links` - no broken or path-based links
- `mise run doc-titles` - no duplicates

Reviewed-on: https://forge.ops.eblu.me/eblume/blumeops/pulls/109

docs/explanation/why-gitops.md

@@ -44,8 +44,8 @@ BlumeOps uses layered GitOps:
 
 | Layer | Tool | What it manages |
 |-------|------|-----------------|
-| **Tailnet** | [[reference/infrastructure/tailscale|Pulumi]] | ACLs, tags, DNS |
-| **Host config** | [[reference/ansible/roles|Ansible]] | Services on [[indri]] |
+| **Tailnet** | [[tailscale|Pulumi]] | ACLs, tags, DNS |
+| **Host config** | [[roles|Ansible]] | Services on [[indri]] |
 | **Kubernetes** | [[argocd|ArgoCD]] | Containerized workloads |
 
 Each layer has its own reconciliation loop:
@@ -67,4 +67,4 @@ But for BlumeOps, the trade-off is worth it. The infrastructure is complex enoug
 
 - [[architecture]] - How the pieces fit together
 - [[argocd]] - Kubernetes GitOps
-- [[reference/ansible/roles|Ansible roles]] - Host configuration
+- [[roles|Ansible roles]] - Host configuration