docs: correct the security posture and document per-instance limits

Why

The docs a security reviewer reads first say things the code does not do, and leave out limits an operator needs to know. Found in the v0.19 review.

docs/security-posture.md: audience enforcement (true only once the token checks fix lands), refresh tokens described as signed (they are opaque), the absolute session lifetime still listed as open (Refresh rotation resets the absolute session lifetime, so there is no absolute cap #185 shipped it), lockout semantics (the rolling window versus lockoutSeconds)
The owner admin grant is described three ways (README, docs/configuration.md, src/lib/ownerAdmin.ts). Make all three match the code
docs/admin-operations.md documents GET /roles; the route is /system-config/roles
The comment in src/controllers/systemConfig.ts near line 149 says the public config survives a tainted config; it does not
A section in docs/production-operations.md on what is per instance today (rate limit counters, the five minute config cache, the OAuth state replay cache) and what that means with more than one instance
Note in docs/fido-conformance.md that the /conformance/* routes are deliberately left out of openapi.json
CLAUDE.md coverage thresholds (says 70/65, enforced 98/98/95/98) and the stale sequelize audit comment in ci.yml

Every claim in the posture doc matches the code at the v0.19.0 tag, and the per-instance limits are documented.