docs: revise to match reality after the bootstrap arc

[hasansezertasan]

Summary

Two days of bootstrap signal applied to every doc. Catches drift accumulated as we learned how HCP, GitHub Pages, cf-terraforming, and branch protection actually behave. Every doc now describes what the repo does, not what it aspired to do at scaffold time.

Per-file

• README.md — real description, what's managed, where things live, contributing rules with the four required checks, pointer to CLAUDE.md.
• docs/ci.md — corrects the (wrong) claim that GitHub Actions calls the HCP API to trigger plans; documents the four required branch protection checks; flags the brittle HCP check name (per-installation VCS-repo ID); notes that docs-only PRs get a single SUCCESS rollup from HCP (we tested this on the previous docs PR).
• docs/state.md — workspaces table lists what each one really manages + its path filter; adds an "API access" section showing how to read the HCP token from `~/.terraform.d/credentials.tfrc.json` and call the API directly (this is how we read plan summaries during the bootstrap).
• docs/secrets.md — trims Cloudflare token scopes to what's actually used; notes the separate short-lived discovery token for cf-terraforming; includes the HCP user API token row that was missing.
• docs/setup.md — drops unused steps (`TF_API_TOKEN` is unused today); reframes local dev around the CLI `plan` allowed / `apply` blocked behavior of VCS-connected workspaces; adds a Troubleshooting section covering the three real issues we hit: HCP webhook subscription drift, GitHub Pages cert wedge (toggle custom domain), and the docs-only PR + branch protection interaction.
• docs/import.md — clarifies CLI `plan` allowed vs `apply` blocked; adds "What we've actually used this for" section documenting scope decisions made during import (excluded personal Pages projects, empty R2 bucket).
• terraform/README.md — refreshes layout to show per-category files (dns.tf, repos.tf, branch_protection.tf, labels.tf); drops the "scaffolding" framing now that real resources exist; notes the deferred HCP-as-code option.

Test plan

• No unintended Salt mentions (`grep -rn -iE 'salt|pillar' --include='*.md'` returns only the two intentional callouts in README and CLAUDE).
• All cross-references between docs still resolve.
• HCP rolls up to SUCCESS (docs-only PR, no workspace runs).
• CI checks green; safe to merge.