docs: rebuild Reqover README around verified demos

[TaeHuiKKIM]

Summary

• run and verify the MVC and WebFlux demos on JDK 21
• add three real Reqover report screenshots with reproducibility notes
• rebuild the root README as a product-first onboarding hub
• stabilize Windows E2E temporary-log cleanup with a bounded retry
• bind every unauthenticated demo workflow to loopback

What changed

• added request-attribution, WebFlux thread-hop, and code-to-endpoint evidence images
• added an exact, safe capture workflow in docs/16_readme_demo_capture.md
• clarified the source-built 0.1.0-SNAPSHOT MVP status, JaCoCo relationship, limitations, and security boundary
• added platform-specific Quickstarts, architecture, compatibility, modules, SBOM, docs, contribution, and maintainer links
• documented the design, implementation plan, and troubleshooting decisions under docs/

Verification

• gradlew.bat clean test build cyclonedxBom --no-daemon --console=plain on JDK 21 — BUILD SUCCESSFUL, 47/47 tasks executed
• MVC: two completed requests, separate GET /orders/{id} and POST /payments cards, and SharedValidator reverse-mapped to both
• WebFlux: GET /auto/reactive/orders/{id}, auto-instrumented controller/service, and multi-thread attribution
• CycloneDX 1.6 SBOM parsed successfully
• local README links, anchors, image dimensions, sensitive paths, ports, processes, and commit authorship audited
• final independent cross-repository review: no findings

Safety and scope

• sample report endpoints remain unauthenticated and are bound to 127.0.0.1 in all documented workflows
• Reqover remains a source-built MVP; no release or package publication is implied
• no environment files, credentials, process logs, browser temporary files, or build outputs are included

Dependency

Merge this PR before the Reqover Labs organization-profile PR so its section anchors resolve on main.