reorg: docs — library/device/ + library/protocol/ structure

Update the docs to match the reorganized tree:

- driver-model.md: the "Families" graph now shows library/device/<domain>/
  (data + logic split) and library/protocol/ instead of the old bus/ + proto/
  sketch; add the microkernel note (the kernel's one library/ import is the
  device-abi data module) and the rule that a driver's hardware command set is
  not a service-seam protocol.
- README.md "Repository layout": device-abi and the protocols move out of
  system/ into library/device/ and library/protocol/; rewrite the "public
  interface as a module" paragraph around the protocol tree and the device
  domains; fix the source-map paths.
- Sweep every remaining stale path reference across docs/ to the moved files.
- Fix vfs-protocol.zig's own header (the standalone VFS server retired; the fat
  server is the backend today).

zig build + test green.

docs/efi.md

@@ -173,7 +173,7 @@ The loader and kernel are two *separate* binaries built for two different target
 so everything they exchange must have an identically-defined memory layout. That's
 what `system/boot-handoff.zig` provides — imported by both as the `boot-handoff` module.
 It is *only* the handoff: the kernel↔user ABI (`system/abi.zig`) and the device types
-(`system/devices/device-abi.zig`) are separate contracts the bootloader never sees.
+(`library/device/model/device-abi.zig`) are separate contracts the bootloader never sees.
 
 - `BootInformation` — the top-level struct passed to the kernel: the
   framebuffer, the memory map, the kernel's own `PT_LOAD` segments