docs(readme): honest capability claims + current db setup path (audits #21, #23, #6)

- 'Physical lock enforcement' -> read-only lock hardening over advisory locks
- Hosted vs local search described as what each actually does (vector+FTS+trigram
  fused with LLM rerank hosted; ripgrep + keyword ranking local)
- Supabase setup now points at 'supabase db reset', schema.sql marked generated