docs: replace dead PR #210 staging-stack references with self-contained target guidance

WHY THIS MATTERS
The load-test harness (workflow, doc, and k6 script) all told operators
to point it at "the staging stack from PR #210". PR #210 was CLOSED
unmerged - it was rejected for leaking admin credentials - so the one
piece of infrastructure the harness claims to require does not exist.
A newcomer following the docs would hit a dead end: the reference reads
as "there is a blessed staging stack somewhere", when in reality there
is no such stack and never will be from that PR. Worse, linking to a
credential-leaking PR as recommended reading is itself a small security
smell. Docs that point at dead artifacts erode trust in all the other
docs around them.

WHAT IS A SELF-CONTAINED REFERENCE
Documentation can either point at an artifact ("use the stack from PR
#210") or describe a contract ("use any stack that serves X behind Y").
Pointers are fragile: PRs get closed, branches get deleted, staging
environments get torn down, and the doc silently rots. A contract-style
reference survives all of that because it tells the operator what the
target must PROVIDE rather than where one specific instance lived. For
an on-demand load harness - which by design boots nothing itself - the
contract is the only stable thing to document.

HOW THE FIX WORKS
Every "#210" reference in the three harness files is replaced with the
actual contract the target stack must satisfy:

  - a deployed, NON-production backend the operator owns,
  - serving the backend API's streaming endpoint:
      POST {BASE_URL}/chat
      Authorization: Bearer <supabase access token>
  - with real LLM provider keys configured (each iteration performs a
    real chat completion).

Concretely:
  - .github/workflows/loadtest.yml: the header comment and the
    `target_url` input description now describe that contract, e.g.
      description: "Backend base URL of a non-production stack you
      deployed (serving the backend API with auth), ..."
  - docs/test-depth.md: the "Running from GitHub Actions" section
    describes the same contract instead of naming PR #210.
  - loadtest/sse-stream.js: the header comment does likewise.

No behavior changes - the workflow inputs, k6 scenario, thresholds, and
safety warnings ("never point at production") are untouched. Verified by
grepping the three files for "#210" (no matches), YAML-parsing the
workflow, and `node --check` on the k6 script.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>