docs(claude-md): trim derivable content from always-loaded memory

[mlevkov]

Summary

CLAUDE.md is loaded in full into every session's context, and roughly 75% of it
restated facts that a session can recover from the repo itself — the directory tree,
the dependency list, env-var tables, CI workflow descriptions. This trims it from
824 to 233 lines (~7.7k → ~2.3k estimated tokens per session) while keeping every
non-derivable contract, gotcha, and design rationale.

Documentation-only: no source files are touched.

Type of Change

• Documentation update

Changes Made

Removed as derivable from the repo:

• Directory tree and architecture diagram — verbatim ls/find output
• API endpoint list — src/routes.rs
• Six env-var tables — every variable and default is defined in src/config.rs
• Observability stack section — all ports are in docker-compose.yaml
• Quick-start and test commands — standard cargo invocations, and the hardcoded
  test counts (183/30/18) had already drifted
• Message format and event types — src/models/event.rs
• Error-type/status-code list — src/error.rs
• Dependency list — Cargo.toml
• CI/CD section — .github/workflows/
• License — LICENSE
• The "no unwrap()/expect()" rule — Cargo.toml [lints.clippy] sets
  unwrap_used = "deny" and expect_used = "deny", and CI runs clippy -D warnings,
  so the build enforces it whether or not the doc says so

Compressed to prose, so the contract survives without the copied code:

• RateLimitError / build_router() startup-failure behavior
• The enum-variant (never string-match) rule for connection-error detection
• Shutdown ordering and the Notify-not-polling rationale, with a pointer to
  docs/structured-concurrency.md
• Middleware invariants: auth meters failures only, fallible RateLimitLayer::new(),
  exact-path bypass
• RATE_LIMIT_BURST replace-not-add semantics, moved out of the deleted table

Kept verbatim (not recoverable from code — these encode why, not what): Iggy SDK
integration rationale, the TRUSTED_PROXIES security contract, request-timeout contracts,
0-indexed partitions, fuzz-test commands, the log-level convention, middleware order,
and deployment security.

Testing

Documentation-only change; no source files touched, so no tests were added and none were
run locally. Verified instead:

• Heading hierarchy has no orphaned subsections after the cuts — survivors were promoted a
  level where their parent heading was removed (### Iggy SDK Integration → ##,
  #### Log Levels → ###)
• Code fences balanced (12, even)
• Every file the trimmed doc now points at exists: src/config.rs, .env.example,
  docs/structured-concurrency.md, docs/README.md
• Only CLAUDE.md is modified

CI runs the full fmt/clippy/test matrix on this branch regardless.

Checklist

Code Quality

• Code follows project style guidelines (cargo fmt) — n/a, no source changes
• No new Clippy warnings — n/a, no source changes
• Public APIs have documentation comments — n/a, no API changes
• Error handling is appropriate — n/a, no source changes

Testing

• Tests cover the happy path / error cases — n/a, no behavior changes
• All existing tests pass — unaffected; no code paths modified

Documentation

• CLAUDE.md updated
• README updated — n/a, no user-facing changes
• Remaining content explains "why" not "what" — that is the organizing principle of
  the trim

Security

• No secrets or credentials committed
• Input validation — n/a, no source changes
• No new security vulnerabilities introduced — the TRUSTED_PROXIES contract and
  deployment-security guidance were deliberately preserved in full

Related Issues

None.

Additional Notes

On the PR size check: pr.yml warns above 500 changed lines; this is 655
(32 insertions, 623 deletions). It is a pure documentation deletion, so the raw line
count overstates the review surface — the 32 inserted lines are the only new prose.

Reverting any single block: git show <this-commit>^:CLAUDE.md has the original file.

Not included here (proposed but deliberately deferred): moving the Deployment Security
section to a lazily-loaded skill, which would save a further ~370 estimated tokens per
session. It stays inline in this PR.