Restructure docs: consolidate, recategorize, and extract

- Consolidate 4 Authentik Nix derivation docs into one card
  (authentik-nix-build-components.md)
- Merge build-grafana-container + build-grafana-sidecar into
  build-grafana-images.md
- Move agent-change-process from how-to/ to explanation/ (it's a
  methodology doc, not a task guide)
- Extract Caddy custom build section from reference card into
  how-to/deployment/build-caddy-with-plugins.md
- Move expose-service-publicly from how-to/ to tutorials/ (it's a
  comprehensive walkthrough, not a quick task reference)
- Update all wiki-link references across affected docs

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

docs/reference/services/caddy.md

@@ -87,20 +87,7 @@ Caddy has no authentication layer — it is a plain reverse proxy. Access contro
 
 ## Custom Build
 
-Caddy is built from source using `xcaddy` with two plugins:
-
-- `github.com/caddy-dns/gandi` — ACME DNS-01 challenges via Gandi API
-- `github.com/mholt/caddy-l4` — Layer 4 (TCP/UDP) proxying
-
-```bash
-# Source and build location (mirrored on forge)
-~/code/3rd/caddy/bin/caddy
-
-# Build via mise task in the caddy clone
-cd ~/code/3rd/caddy && mise run build
-```
-
-Forge mirrors: `mirrors/caddy`, `mirrors/caddy-gandi`, `mirrors/xcaddy`, `mirrors/caddy-l4`.
+Custom `xcaddy` build with Gandi DNS and L4 plugins. See [[build-caddy-with-plugins]] for build instructions and forge mirror details.
 
 ## Related
 

docs/reference/services/grafana.md

@@ -59,8 +59,7 @@ Optional annotation: `grafana_folder: "FolderName"`
 
 ## Related
 
-- [[build-grafana-container]] - Home-built container image
-- [[build-grafana-sidecar]] - Home-built sidecar container
+- [[build-grafana-images]] - Home-built container images (Grafana + sidecar)
 - [[kustomize-grafana-deployment]] - Kustomize manifest structure
 - [[authentik]] - OIDC identity provider for SSO
 - [[migrate-grafana-to-authentik]] - How SSO was migrated from Dex to Authentik