docs: take one site's name, hosts and paths off the public wiki

The publishability gate caught internal tooling names and developer paths but
nothing site-specific, so roughly sixty leaks reached the wiki: the site name in
ten documents, real fleet hostnames in the collector and GE-Enforce examples, an
internal database name through the whole import guide, imaging-share paths, and
a maintainer's username as the Deciders line of every ADR and inside a generated
curl example.

None of it is a security matter on an air-gapped fleet. It matters because these
pages are read by engineers at other plants, and a document that names one site
throughout reads as that site's notes rather than a product's documentation -
which is exactly what it then gets treated as.

Examples now use neutral hostnames, the site is "the reference site" where the
distinction carries meaning, and ADRs are decided by "ShopDB maintainers". The
gate carries all of these patterns, so the next one fails a build.

Two documents leave docs/ because they were never written for an outside reader.
PROJECT-REVIEW.md is an internal health memo pinned to a commit from July, whose
headline finding (an untracked playbook) has since been fixed - it is history,
and git holds it. PILOT-DEPLOY.md is one site's own cutover runbook, complete
with a "re-measure before publishing" placeholder; it moves next to the loader
it belongs to, in scripts/site_imports/wjf/.

ADR-015 is AMENDED rather than rewritten. Its enforcement section still said
report-only and its backlog still listed hardcodes that are now cleared, which
left the record contradicting itself. The amendment says what changed and why
the report-only period ended; the original text stays, because what the decision
looked like when it was taken is the part worth keeping.

Also corrects llms.txt's response envelope, which had errors at the top level
and pagination at meta.total. Both are nested one deeper, so anything written
against that description read undefined on every error it tried to handle.

docs/IMPORT-ADOPTION.md

@@ -36,7 +36,7 @@ site's schema. So the import is split in two layers:
 2. **A per-site loader is thin glue.** It reads *your* source database and POSTs
    to those endpoints. Nobody runs another site's loader - you copy the pattern.
 
-The West Jefferson loader in `scripts/site_imports/wjf/` is reference
+The the reference site loader in `scripts/site_imports/wjf/` is reference
 implementation #1. Read it alongside this guide.
 
 ## The shape of a loader
@@ -89,7 +89,7 @@ onboarding path.
    UI spot-check (log in, eyeball the lists / map / a detail page).
 5. Only then point a real instance at the imported database.
 
-## What the WJ loader demonstrates
+## What the reference loader demonstrates
 
 - Fanning one legacy "machine" table out to the flask asset types
   (computer/machine/network/measuring-tool) by a routing rule, with the