docs: comprehensive refresh — README, API reference, user manuals (EN + zh-TW), screenshots

[ninedter]

Comprehensive documentation pass covering the optimization work, the multi-provider LLM integration, the OSINT/UX fixes, and the YARA rules configuration.

What changed

• API reference (docs/API.md, docs/api/README.md, zh-TW landing): every endpoint (19 routes) now has a detailed explanation, a complete curl sample request, an exact-shape sample JSON response with status code, and per-endpoint error variants. Reconciled 1:1 against the live create_app() route table — zero missing, zero phantom. Fixed 10 real code-vs-docs drifts (key-ID format, env-var semantics, naive-vs-Z timestamps, the undocumented STIX alias route, etc.).
• README: Docker-first quickstart, CI badge, Python 3.11+, refreshed Visual Tour (incl. a new LLM-provider close-up), feature list synced to current behavior, full make-targets table, concurrent-pipeline description.
• User manuals (docs/en/USER_MANUAL.md + full docs/zh-TW/ tree): new-analyst walkthrough of every tab and feature — explainable risk, honest provider-status pills, LLM Integration (LM Studio / OpenAI / Anthropic), YARA rules config, per-run artifact retention. zh-TW is Traditional Chinese with Taiwan-standard wording (verified clean of Simplified terms).
• Screenshots: all 8 tab images regenerated from a live sample.pcap run (real data, IPs auto-redacted) plus a new 09-llm-providers.png.
• Installer (scripts/install.py, scripts/check_dependencies.py): dependency check now covers all current runtime packages (anthropic, kaleido, plotly, fastapi/uvicorn, …) with required/optional markers; added the missing Linux WeasyPrint package (libpangocairo-1.0-0 + font/mime deps) to match the Dockerfile/CI set.
• Capture tooling (scripts/capture_screenshots.py): hardened — container-relative --pcap, fail-fast on a rejected path, waits for the LLM report, captures the provider close-up.

Verification

• make verify — 1000 passed, ruff format + lint clean.
• All image and relative-link references resolve across the 7 updated docs.
• zh-TW Simplified-character sweep clean.
• Screenshots visually confirmed (dashboard risk-explainer, config YARA/LLM sections, redacted IPs).
• No application code changed — docs + tooling only.