docs: pre-1.0 readiness pass for public beta launch (#1225)

Close the trust-blocking items from the pre-v1.0 readiness audit so the
repository is ready for the first public posting. No backend or
frontend code changes; no tier gates move.

README:
- Add a single beta-status GitHub [!NOTE] callout below the dashboard
  image. Beta status also appears in selected install-flow docs
  (Quickstart, Known Limitations, Security Architecture, Upgrade,
  Troubleshooting) so install-flow readers are not surprised.
- Add a "Before you install" subsection that names the docker.sock
  privilege model with the Portainer / Dockge / Komodo comparison.
- Fix the docker run example: add the missing /opt/docker:/opt/docker
  mount that COMPOSE_DIR=/opt/docker depends on.
- Reword the two "no exposed Docker socket" sentences so the claim is
  scoped to remote / cross-node exposure.
- Reword "transparent HTTPS proxy" to "authenticated HTTP and WebSocket
  proxy" with a TLS / VPN reminder.
- Fix the RBAC bullet: the role set is admin, viewer, deployer,
  node-admin, auditor. There is no "editor" role.
- Add tier markers to the Capabilities list (matrix sentence plus
  per-bullet (Skipper) / (Admiral) markers), verified against the
  route guards in backend/src/routes/.
- Fix the broken notification-routing link to point at the existing
  alerts-notifications#notification-routing anchor.
- Soften the BSL paraphrase to point at LICENSE plus the license FAQ.
- Add a "Telemetry and data handling" section: no telemetry, no
  analytics, no crash reports; license validation only when a paid key
  is activated.
- Add a "What Sencho is not (yet)" section so the scope boundaries are
  visible above Capabilities.

Templates:
- PR template: drop the contradictory CHANGELOG checkbox; release-please
  owns CHANGELOG.
- Bug report template: update the stale 0.2.2 version placeholder to
  0.86.6 and add fields for compose snippet, container logs, browser
  console, and an involved-subsystems checkbox.

Docs:
- docs/operations/trivy-setup.mdx: replace both sencho/sencho:latest
  occurrences with the published image saelix/sencho:latest.
- docs/reference/settings.mdx: rewrite the API Tokens Note (no tier
  gate in code; admin role only) and the Stack Labels Note (basic
  CRUD is free; only bulk actions require Skipper or Admiral).
- Add the shared beta-status Note callout to docs/getting-started/
  quickstart.mdx, docs/operations/upgrade.mdx, docs/operations/
  troubleshooting.mdx, and docs/reference/security.mdx.

CONTRIBUTING:
- Replace the public link to the in-repo coding-rules file with a
  pointer to docs.sencho.io for architecture deep-dives.
- Fix the sample clone URL case (Sencho.git becomes sencho.git).

New files:
- SUPPORT.md: where to ask, response-time expectations, in / out of
  scope.
- KNOWN_LIMITATIONS.md: scale, platform, architecture, and feature
  limits documented for the beta audience; scale numbers marked "not
  benchmarked yet" pending real benchmarking.

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -29,7 +29,7 @@ body:
     id: version
     attributes:
       label: Sencho version
-      placeholder: "0.2.2"
+      placeholder: "0.86.6 (find this in Settings → About)"
     validations:
       required: true
   - type: dropdown
@@ -54,3 +54,34 @@ body:
       label: Relevant logs
       description: Paste any relevant container or browser console logs
       render: shell
+  - type: textarea
+    id: compose
+    attributes:
+      label: Compose snippet (if a stack is involved)
+      description: Paste the relevant `services:` block. Redact secrets first.
+      render: yaml
+  - type: textarea
+    id: container_logs
+    attributes:
+      label: Container logs
+      description: Output of `docker logs sencho` from the time of the issue.
+      render: shell
+  - type: textarea
+    id: browser_console
+    attributes:
+      label: Browser console output (if a UI issue)
+      description: Open DevTools, reproduce, copy any errors or warnings.
+      render: shell
+  - type: checkboxes
+    id: subsystems
+    attributes:
+      label: Subsystems involved
+      description: Tick any that apply.
+      options:
+        - label: Trivy / vulnerability scanning
+        - label: Pilot Agent (NAT tunnel)
+        - label: Sencho Mesh (cross-node networking)
+        - label: Fleet Actions / Secrets / Snapshots
+        - label: Cloud Backup
+        - label: SSO / LDAP
+        - label: None of the above

.github/PULL_REQUEST_TEMPLATE.md

@@ -12,4 +12,4 @@
 - [ ] Documentation updated (if applicable)
 - [ ] ESLint passes (`npm run lint` in backend/ and frontend/)
 - [ ] Commit messages follow Conventional Commits
-- [ ] CHANGELOG.md updated under `## [Unreleased]` (for user-facing changes)
+- [ ] Commit message follows Conventional Commits (the CHANGELOG entry is generated from the commit subject by release-please; do not edit `CHANGELOG.md` directly).