docs: resolve documentation audit findings for 2026-04-09

[j-shilling]

Summary

• add the dated documentation audit report at docs/audit/2026-04-09_11:17:37.md
• align runtime docs with the current Go routes, Redis wiring, and SKIP_AUTH middleware behavior
• replace missing OpenAPI maintenance wrapper commands with the supported mise and pnpm workflows
• fix one broken mailto link found during post-fix hygiene validation

What was fixed

• refreshed README.md, api-spec/README.md, and docs/planning/public-api-data-model-design-first.md so they only reference commands that exist on this branch
• rewrote docs/api.md, docs/overview.md, docs/architecture.md, and related feature docs to match the current route inventory and middleware wiring
• corrected docs/setup.md to match current config keys and the checked-in compose stack
• updated the security feature page to describe the currently wired SkipAuthMiddleware

Remaining unresolved

• the generated audit report still records a FAIL gate because it captures the pre-fix state that drove this patch
• the underlying runtime still does not enforce the bearer-token auth described by the v0 contract; this PR only makes the docs truthful about that gap
• local git branch/commit operations were blocked by worktree metadata sandbox restrictions, so the branch and commit were published through the GitHub app against the current HEAD

Verification

• pnpm exec markdownlint-cli2 README.md AGENTS.md api-spec/README.md "docs/**/*.md"
• relative markdown link/path validation for README.md, AGENTS.md, api-spec/README.md, and docs/**/*.md
• targeted markdown secret-pattern scan (matches only prior audit command text)

Audit report

• docs/audit/2026-04-09_11:17:37.md