docs: rewrite features.md, audit README + architecture against repo

Rewrote docs/features.md from scratch as authoritative feature inventory
(1255 lines, every claim verified against source files).

Audited README.md and architecture.md against repo — fixed 19 stale
references: K8s Secrets status, issuer counts, dashboard page counts,
CI thresholds, missing connectors in Mermaid diagrams, OpenAPI operation
count, GetCACertPEM behavior, and V2/V4 roadmap accuracy.

Also includes related fixes discovered during audit:
- Scheduler skips expired/failed/revoked certs from auto-renewal
- Seed demo expiry dates moved outside 31-day scheduler query window
- Agent pages use correct last_heartbeat_at field name

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

web/src/pages/AgentDetailPage.tsx

@@ -61,7 +61,7 @@ export default function AgentDetailPage() {
     );
   }
 
-  const health = agent.status || heartbeatStatus(agent.last_heartbeat);
+  const health = agent.status || heartbeatStatus(agent.last_heartbeat_at);
 
   return (
     <>
@@ -82,10 +82,10 @@ export default function AgentDetailPage() {
             <InfoRow label="IP Address" value={<span className="font-mono text-xs">{agent.ip_address || '—'}</span>} />
             <InfoRow label="Version" value={agent.version || '—'} />
             <InfoRow label="Last Heartbeat" value={
-              agent.last_heartbeat ? (
+              agent.last_heartbeat_at ? (
                 <span>
-                  {timeAgo(agent.last_heartbeat)}
-                  <span className="text-ink-faint ml-2 text-xs">{formatDateTime(agent.last_heartbeat)}</span>
+                  {timeAgo(agent.last_heartbeat_at)}
+                  <span className="text-ink-faint ml-2 text-xs">{formatDateTime(agent.last_heartbeat_at)}</span>
                 </span>
               ) : '—'
             } />