docs: resolve documentation audit findings for 2026-04-24

[j-shilling]

Summary

• add the dated audit report at docs/audit/2026-04-24_12-25-05.md
• fix runtime/setup/docs drift for current routes, middleware behavior, environment variables, and supported contract-tooling commands
• repair AGENTS.md and public guides so they reference current branch paths and examples

What Was Fixed

• rewrote docs/api.md, docs/overview.md, and docs/architecture.md to match the live Fiber routes and middleware stack
• corrected docs/setup.md environment-variable guidance to match pkg/core/config.go
• replaced nonexistent OpenAPI helper-script references in README.md, api-spec/README.md, and docs/planning/public-api-data-model-design-first.md with supported mise and pnpm workflows
• updated feature and guide docs for the current request-subject and NSC handler behavior

What Remains Unresolved

• the checked-in v0 contract still documents OAuth 2.0 client-credentials auth, while the current Go runtime only derives request identity from headers and bearer-token parsing without a verifying auth middleware
• this PR documents that split clearly, but it does not change runtime behavior or the published contract

Audit Report

• docs/audit/2026-04-24_12-25-05.md

Validation

• markdownlint-cli2 README.md AGENTS.md api-spec/README.md schema/README.md "docs/**/*.md"
• relative markdown link/path validation across reviewed docs
• regex-based tracked-file secret sweep (fallback because gitleaks is not installed locally)