docs: wiki staleness sweep (Fable-orchestrated Opus audit)

Audited all 40 docs/ against the live codebase; fixed factual staleness in 23,
14 were clean. Highlights (all verified against code):
- equipment -> machines (ADR-011 rename) in INSTALL/DEPLOY-WINDOWS-IIS,
  PLUGIN-GUIDE, GE-ENFORCE, ROADMAP.
- Versions refreshed: contract 0.10.0 -> 0.13.0, product 0.5.0 -> 0.7.0, plus
  plugin example core_version pins.
- Bundled set corrected to the current 13 (PLUGINS.md 7 -> 13 rows; DEPLOY
  eleven -> thirteen).
- Per-plugin Alembic chain workflow (ADR-008) replacing stale core-chain steps
  in PLUGIN-QUICKSTART / BACKUP-RESTORE; deploy adds plugin upgrade-all.
- Frontend plugin staging (ADR-010) replacing 'no frontend plugin system yet'
  in PLUGIN-GUIDE; view/route paths repointed to plugins/<name>/frontend/.
- Corrected file paths (MapView.vue, manifest_schema.json), CLI (shelf-list),
  API gating (GET /api/plugins is optional-jwt), WJF 15 -> 16 stages, and
  retired Collector/PC-Types settings pages (ADR-012).
- ge-enforce proposal marked ACCEPTED/built.

docs/GE-ENFORCE-CLIENT.md

@@ -88,7 +88,7 @@ POST /api/geenforce/report
   present), `skipped` (detected present), `failed`, `filtered`. `selfhealed`
   marks a drift correction.
 - shopdb keeps the latest report per (hostname, scope, phase) plus history, and
-  surfaces it under Settings > Enforcement Reports.
+  surfaces it under GE-Enforce > Enforcement Reports.
 
 The engine already computes these counts (`installed/skipped/failed/pcFiltered`
 at the end of its main loop) and knows each entry's action; shape them into the
@@ -105,7 +105,7 @@ with `Installed/Skipped/Failed/Filtered` + a `Results` list).
 3. **Read cutover**: drop `-ShadowMode`. The engine now runs against the
    shopdb-sourced manifest; payloads still come from the share. Rollback is a
    one-line revert to the share-sourced call. Keep exporting manifests from
-   shopdb to the share (Settings > Imaging PC Types > Export to Share) so the
+   shopdb to the share (GE-Enforce > Manifests > Export to Share) so the
    share stays a break-glass copy.
 4. **Payload migration** (optional, later): move small scripts/configs to
    `http`/`inline` payloads, verified by `payloadsha256`. Big MSIs stay on SMB.