docs: pre-1.0 readiness pass for public beta launch (#1225)

Close the trust-blocking items from the pre-v1.0 readiness audit so the
repository is ready for the first public posting. No backend or
frontend code changes; no tier gates move.

README:
- Add a single beta-status GitHub [!NOTE] callout below the dashboard
  image. Beta status also appears in selected install-flow docs
  (Quickstart, Known Limitations, Security Architecture, Upgrade,
  Troubleshooting) so install-flow readers are not surprised.
- Add a "Before you install" subsection that names the docker.sock
  privilege model with the Portainer / Dockge / Komodo comparison.
- Fix the docker run example: add the missing /opt/docker:/opt/docker
  mount that COMPOSE_DIR=/opt/docker depends on.
- Reword the two "no exposed Docker socket" sentences so the claim is
  scoped to remote / cross-node exposure.
- Reword "transparent HTTPS proxy" to "authenticated HTTP and WebSocket
  proxy" with a TLS / VPN reminder.
- Fix the RBAC bullet: the role set is admin, viewer, deployer,
  node-admin, auditor. There is no "editor" role.
- Add tier markers to the Capabilities list (matrix sentence plus
  per-bullet (Skipper) / (Admiral) markers), verified against the
  route guards in backend/src/routes/.
- Fix the broken notification-routing link to point at the existing
  alerts-notifications#notification-routing anchor.
- Soften the BSL paraphrase to point at LICENSE plus the license FAQ.
- Add a "Telemetry and data handling" section: no telemetry, no
  analytics, no crash reports; license validation only when a paid key
  is activated.
- Add a "What Sencho is not (yet)" section so the scope boundaries are
  visible above Capabilities.

Templates:
- PR template: drop the contradictory CHANGELOG checkbox; release-please
  owns CHANGELOG.
- Bug report template: update the stale 0.2.2 version placeholder to
  0.86.6 and add fields for compose snippet, container logs, browser
  console, and an involved-subsystems checkbox.

Docs:
- docs/operations/trivy-setup.mdx: replace both sencho/sencho:latest
  occurrences with the published image saelix/sencho:latest.
- docs/reference/settings.mdx: rewrite the API Tokens Note (no tier
  gate in code; admin role only) and the Stack Labels Note (basic
  CRUD is free; only bulk actions require Skipper or Admiral).
- Add the shared beta-status Note callout to docs/getting-started/
  quickstart.mdx, docs/operations/upgrade.mdx, docs/operations/
  troubleshooting.mdx, and docs/reference/security.mdx.

CONTRIBUTING:
- Replace the public link to the in-repo coding-rules file with a
  pointer to docs.sencho.io for architecture deep-dives.
- Fix the sample clone URL case (Sencho.git becomes sencho.git).

New files:
- SUPPORT.md: where to ask, response-time expectations, in / out of
  scope.
- KNOWN_LIMITATIONS.md: scale, platform, architecture, and feature
  limits documented for the beta audience; scale numbers marked "not
  benchmarked yet" pending real benchmarking.

docs/reference/security.mdx

@@ -5,6 +5,10 @@ description: How Sencho protects your infrastructure with layered authentication
 
 Sencho applies defense-in-depth across authentication, authorization, encryption, and auditing. All security features ship with sensible defaults and work out of the box on a fresh install.
 
+<Note>
+  Sencho is currently in public beta on the path to v1.0. Core workflows are actively tested, but early users should review the [known limitations](https://github.com/studio-saelix/sencho/blob/main/KNOWN_LIMITATIONS.md) and avoid deploying it blindly on critical infrastructure without testing in their own environment first.
+</Note>
+
 ## The authentication stack
 
 Every self-hosted instance includes the full security stack, with advanced features unlocked by tier.