docs: describe the system that exists, not the one we started with

The README still opened on "Primary School Compass", a KS2 tool for Wandsworth
and Merton served by FastAPI and vanilla JavaScript with Chart.js. Every layer
of that sentence is now wrong: coverage is England-wide across KS2, KS4,
all-through and post-16, Next.js owns the public UI, and school data comes from
dbt-built `marts.*` rather than CSVs loaded at startup. The setup instructions
walked a reader into a virtualenv and a CSV import that cannot build the current
schema, so following the docs produced an empty database and a wrong mental
model at the same time.

Replace the narrative docs with two reference documents that were checked
against the code: docs/ARCHITECTURE.md for request flow, data ownership, the
backend/frontend module boundaries and the real publication sequence, and
docs/DEVELOPMENT.md for the checks that actually run, including the container
and CI version skew that makes "just run pytest" misleading.

The env examples drifted the same way. ALLOWED_ORIGINS is a JSON array, not a
comma-separated list; the frontend needs FASTAPI_URL, DATABASE_URL and
PAYLOAD_SECRET, none of which were documented; and RATE_LIMIT_BURST,
DEFAULT_PAGE_SIZE and MAX_PAGE_SIZE were presented as tuning controls the routes
do not consult. Each is now stated as it behaves.

MIGRATION_SUMMARY.md keeps its content but gains a banner, because it reads like
setup instructions and is not.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016y2J6bs8gbuSJbH18w7Tan

nextjs-app/.env.example

@@ -1,8 +1,16 @@
-# API Configuration
-NEXT_PUBLIC_API_URL=http://localhost:8000/api
+# Browser requests use the same-origin Next.js proxy.
+NEXT_PUBLIC_API_URL=/api
 
-# Production API URL (for deployment)
-# NEXT_PUBLIC_API_URL=https://api.schoolcompare.co.uk/api
+# Absolute URL for server-side fetching and the proxy; include /api.
+# In the managed container network this is http://backend:80/api (staging differs).
+FASTAPI_URL=http://localhost:8000/api
+
+# Payload CMS runtime configuration. Use the managed environment's database;
+# Payload owns the payload schema, independently of the school marts.
+DATABASE_URL=postgresql://schoolcompare:CHANGE_THIS_PASSWORD@localhost:5432/schoolcompare
+# Generate a secret: python -c "import secrets; print(secrets.token_urlsafe(32))"
+# Use distinct secrets for staging and production.
+PAYLOAD_SECRET=CHANGE_THIS_TO_A_SECURE_RANDOM_SECRET
 
 # Node Environment
 NODE_ENV=development