Clean up documentation per the documentation conventions

[alistair3149]

A pass over the prose documentation applying docs/documentation-conventions.md (#479).

• One home per fact: configuration.md restated the four hosted-proxy environment variables (semantics, defaults, duration grammar, activation conditions) and two core OAuth variables whose homes are the deployment.md and README tables. Both subsections are now short pointers; the MCP_PUBLIC_URL discovery-role fact, which had no other home, is kept.
• Audience mismatch: configuration.md's "HTTP transport behaviour" subsection described deployment behaviour — discovery publishing, 401 challenge conditions, per-request bearer semantics, session TLS guidance — to the config-file reader. Its unique facts merge into deployment.md's per-request-bearer section (also resolving the tension between "single-wiki only for now" there and the multi-wiki-per-session semantics here), with a pointer left behind. README's "Internal vs public address" paragraph shrinks to a note, its link-construction contract moving under the per-wiki fields; the README security bullet that repeated the outbound SSRF-guard reference nearly verbatim becomes a pointer.
• Protocol narration in deployment.md: "How the proxy works" is compressed to the facts an admin acts on — the /mcp bearer is a proxy-minted token, the MediaWiki token stays server-side and is refreshed through the confidential consumer, and the per-wiki challenge behaviour. This also removes the stale claim that the proxy brokers the upstream consumer as a public + PKCE client, which the confidential-consumer requirement obsoleted. The per-request-bearer discovery walkthrough shrinks to its contract and the spec-alignment design note is dropped.
• Never-write register: dropped two justification sentences, the MCP-Roots roadmap callout (its contract — the allowlist is fixed at startup — is kept as a sentence), a doc-about-itself sentence in the e2e walkthrough, and a redundant third pointer to "How the proxy works". Replaced two named-client example lists with "an MCP client" / "OAuth-aware MCP clients".
• Mechanical: grammar fixes in three README install blocks; moved the /var/www/html remark in testing.md next to the command it qualifies; the GIT_SHA build-arg explanation cut to a clause.

Considered, omitted:

• configuration.md's "For wiki admins" section addresses a second reader, but it is explicitly labelled and the wiki-side half of the setup has no better home.
• deployment.md's env-var tables, security checklist, Host/Origin matching edge cases, SSRF-guard rules, persistence, and v1 limitations: all actionable for the admin reader, left intact.
• testing.md's e2e proxy walkthrough, operations.md, and releasing.md match their genre readers; no changes beyond the above.
• Historical CHANGELOG entries: dated snapshots, left untouched.
• README install sections naming clients: install instructions, not example lists.

🤖 Generated with Claude Code