docs: separate the install guides from the reference material they had absorbed

Both install guides had grown sections that were not install steps, which is what made the multi-node one hard to follow. Each now ends on a step that hands off to Setting Up Your Cluster, and the reference material moves under Administration where it can be read on its own.

- Single-node and multi-node both end on a "Set Up Your Cluster" step rather than a trailing sentence.
- The multi-node cluster-state check via `spx admin kv digest` is gone. Verification is now every node Ready, capacity pooled, and the AWS API answering.
- "How Multi-Node Storage Works" becomes docs/admin/predastore-distributed-storage, expanded with the host and node model, the write and read paths, degraded writes, hinted handoff, repair, encryption at rest, and what each class of failure costs.
- "Firewall and Cluster Membership" becomes docs/admin/host-firewall, expanded with the full public, cluster and encap port groups, how to narrow SSH, and which files under /etc/spinifex/firewall survive an upgrade.
- Setting Up Your Cluster gains a closing step that arms the firewall and narrows SSH, so the securing work lands after a cluster that works rather than during the install.

install-usb and vpc-networking followed the two moved sections to their new paths.

docs/compute/vpc-networking/README.md

@@ -923,7 +923,7 @@ firewall_enabled = true
 
 Before enabling it, check what else the machine is serving — anything listening
 outside the public port group stops accepting new connections. See
-[Firewall and Cluster Membership](/docs/install-multi-node#firewall-and-cluster-membership)
+[Host Firewall](/docs/host-firewall)
 for the full port policy and the cluster-formation steps.
 
 ### Verifying it