docs: describe the split frontend CMS runtime

[glitchedmob]

Replace stale frontend wiring and import instructions with the current native CMS contract.

• Document matching server-only bridge secrets, native Delivery keys and the frontend reset-link origin.
• Explain why native CORS middleware does not authorize browser CMS calls.
• Retire the historical Everything import recipe and describe builtin-only member schema limits.
• Distinguish the tracked Mailpit image from the cached version used for the native auth/reset proof.