Rewrite README for PIP, document phases done and outstanding

Replaces the upstream Mike-era README with a PIP-shaped one:

  - Stack reflects the post-Phase-2 reality: Next.js 16 + Auth.js,
    Express + plain pg, Postgres-only (no Supabase anywhere).
  - Quick start covers the new requirements: createdb + BYPASSRLS,
    AUTH_SECRET on both sides, USER_API_KEYS_ENCRYPTION_SECRET,
    BOOTSTRAP_ADMIN_EMAIL, npm run migrate.
  - First-run notes call out the onboarding wizard, the canonical
    org system prompt, and Account > Custom Instructions.
  - Troubleshooting refreshed for the new boot-time checks
    (AUTH_SECRET, encryption secret, BYPASSRLS, RESEND_API_KEY).

Roadmap section is the canonical place to track progress: Phase 0,
Phase 1, and Phase 2 are listed under Done with a summary of what
shipped and the audit findings each phase closed. Phase 3-8 stay
under Outstanding and get pulled across as they complete.
Parked items called out separately.

The original upstream Supabase/R2-only setup instructions are gone.