chore(setup): track config.php directly, slim README to setup checklist

config/config.php was gitignored and devs had to copy it from
config/config.php.example on every fresh clone. Since the bootstrap
config reads everything from .env via $envString() / $envInt() /
$envBool() defaults, there is nothing developer-specific in the file —
the cp step was dead ceremony.

- Remove config/config.php from .gitignore and track it directly
- Delete config/config.php.example
- Drop the example-existence + per-doc reference checks from
  bin/docs-drift-check.sh; add a legacy-pattern check that flags
  any new mention of the removed example file
- Update ConfigContractsTest to require config.php and forbid the
  example
- Clean stale references in CLAUDE.md, README.md, six docs files,
  and the core-guardrails skill

Same commit slims README down from 294 to 47 lines: one setup
checklist (now 3 commands instead of 4), the seeded login table,
the three quality-gate commands, and pointers to CLAUDE.md and
docs/index.md for everything else.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

tests/Architecture/ConfigContractsTest.php

@@ -14,7 +14,7 @@ final class ConfigContractsTest extends TestCase
             'config/assets.php',
             'config/routes.php',
             'config/modules.php',
-            'config/config.php.example',
+            'config/config.php',
         ];
         foreach ($required as $file) {
             $this->assertFileExists($this->projectRootPath() . '/' . $file, 'Missing required config file: ' . $file);
@@ -23,15 +23,16 @@ final class ConfigContractsTest extends TestCase
         $forbidden = [
             'config/router.php',
             'config/settings.php',
+            'config/config.php.example',
         ];
         foreach ($forbidden as $file) {
             $this->assertFileDoesNotExist($this->projectRootPath() . '/' . $file, 'Forbidden runtime config file exists: ' . $file);
         }
     }
 
-    public function testConfigExampleDoesNotDefineLegacyRouteConstants(): void
+    public function testConfigDoesNotDefineLegacyRouteConstants(): void
     {
-        $content = $this->readProjectFile('config/config.php.example');
+        $content = $this->readProjectFile('config/config.php');
 
         $this->assertStringNotContainsString('APP_ROUTE_DEFINITIONS', $content);
         $this->assertStringNotContainsString('APP_PUBLIC_PATHS', $content);