[codex] Align docs with runtime behavior

[winhowes]

Summary

• Align docs with the current runtime behavior for incoming auth, denylist ordering, rate-limit keys, secret backend loading, and metrics output.
• Fix helper CLI examples so global flags appear before subcommands, and clarify the helper capability registry versus runtime capabilities.
• Update stale examples and FAQ entries for Go version, wildcard allowlist examples, AWS/secret backend behavior, and debugging guidance.

Validation

• go test ./...
• go run ./cmd/integrations -file <tmp>/config.yaml list
• go run ./cmd/allowlist list
• go install ./cmd/integrations && go install ./cmd/allowlist
• git diff --check