Prepare repository for MIT public source publication

[maximalfocus]

Summary

• add the complete MIT License and matching package metadata while retaining private: true
• expand public documentation for purpose, setup, architecture, safety, provenance, export, and limitations
• keep publication preparation separate from the later repository-visibility mutation

Verification

• npm test — 28 tests passed, including integrated guided-flow acceptance
• npm run typecheck — passed
• npm run lint — passed
• npm run build — passed
• npm audit --audit-level=high — 0 vulnerabilities
• local Vite startup and HTTP readback — passed
• checksum-verified Gitleaks 8.30.1 current-tree/history/PR-ref/metadata/Actions scan — no leaks
• private-reference scan across current files, reachable history, issue/PR content, and Actions logs — clean
• GitHub surface audit — one main branch; no tags, releases, artifacts, Pages site, environments, repository secrets, or content edit revisions

Publication boundary

This PR does not change visibility, deploy, host, or publish a package. The implementation repository remains private until this PR lands and the separate publication readback gate passes. The PRD repository remains private.

Closes #11