docs: rewrite README as sink-agnostic, add Wazuh/HTTP/Helm sections

[onelrian]

Overview

The README still positions this project as a Loki-specific exporter under its old name and architecture, and documents an initiator_email Loki label that the code never actually sets. Once the sink architecture, persistence, observability, and Helm work land, the docs need a full pass to describe the real, current system rather than the original single-sink prototype.

Intent

The real intent of this issue is:

Docs that describe last quarter's single-sink prototype actively mislead anyone evaluating this project for the exact multi-sink, self-hosted-NetBird use case it now targets. This is the public face of the rename decision and the sink-architecture work, and needs to land in step with them, not trail behind.

Source of Truth

README.md: title/description still say "Loki exporter" and "Signal," the architecture Mermaid diagram shows only Signal -> Loki, and the Log Labels table documents initiator_email (admin@example.com) as a label that src/loki.rs::send_events never inserts into the labels map.

Tasks

• Update title, badges, and description for the auditbridge name and repository path.
• Rewrite the architecture Mermaid diagram to show the pluggable sink model (NetBird API to auditbridge to Loki/Wazuh/generic HTTP).
• Add a Wazuh setup section (syslog target configuration) once the sink work lands.
• Add a generic HTTP/webhook sink setup section.
• Add a Helm installation section once the chart work lands, replacing the raw-YAML Kubernetes example.
• Fix or remove the initiator_email label documentation to match actual emitted labels (resolves the label drift identified in a separate tracked issue).
• Update the configuration reference table for every new env var introduced by the other issues (backoff, _FILE secrets, metrics port, cursor file path, sink selection).

Acceptance Criteria

• Every documented feature, label, and config option in the README is verifiably true of the current code at merge time.
• No references to the old "signal"/Loki-only framing remain.

Definition of Done

• Acceptance criteria satisfied.
• Docs PR opens only after, or alongside in the same PR as, the features it documents, not before.
• No unresolved blocker remains.