docs: take one site's name, hosts and paths off the public wiki

The publishability gate caught internal tooling names and developer paths but
nothing site-specific, so roughly sixty leaks reached the wiki: the site name in
ten documents, real fleet hostnames in the collector and GE-Enforce examples, an
internal database name through the whole import guide, imaging-share paths, and
a maintainer's username as the Deciders line of every ADR and inside a generated
curl example.

None of it is a security matter on an air-gapped fleet. It matters because these
pages are read by engineers at other plants, and a document that names one site
throughout reads as that site's notes rather than a product's documentation -
which is exactly what it then gets treated as.

Examples now use neutral hostnames, the site is "the reference site" where the
distinction carries meaning, and ADRs are decided by "ShopDB maintainers". The
gate carries all of these patterns, so the next one fails a build.

Two documents leave docs/ because they were never written for an outside reader.
PROJECT-REVIEW.md is an internal health memo pinned to a commit from July, whose
headline finding (an untracked playbook) has since been fixed - it is history,
and git holds it. PILOT-DEPLOY.md is one site's own cutover runbook, complete
with a "re-measure before publishing" placeholder; it moves next to the loader
it belongs to, in scripts/site_imports/wjf/.

ADR-015 is AMENDED rather than rewritten. Its enforcement section still said
report-only and its backlog still listed hardcodes that are now cleared, which
left the record contradicting itself. The amendment says what changed and why
the report-only period ended; the original text stays, because what the decision
looked like when it was taken is the part worth keeping.

Also corrects llms.txt's response envelope, which had errors at the top level
and pagination at meta.total. Both are nested one deeper, so anything written
against that description read undefined on every error it tried to handle.

docs/IMPORT-API.md

@@ -1,7 +1,7 @@
 # Import API: migrating the classic ASP shopdb through HTTP alone
 
 This is the operator manual for importing the legacy Classic-ASP shopdb database
-(`prodscratch` on the dev MySQL container) into shopdb-flask using ONLY the HTTP
+(`legacyshopdb` on the dev MySQL container) into shopdb-flask using ONLY the HTTP
 API. No direct writes to the `shopdb_flask` database are needed or wanted: every
 row is created through a documented endpoint so authorization, validation,
 auditing, and plugin hooks all run exactly as they do for a human operator.
@@ -365,7 +365,7 @@ dispositions below are DECIDED, not open questions.
 
 ### DECIDED: skip (structure only or low value)
 
-- **`compliance`, `compliancescans`** - 0 rows in `prodscratch`. No data to
+- **`compliance`, `compliancescans`** - 0 rows in `legacyshopdb`. No data to
   migrate; a future compliance plugin would own them. Skip.
 - **`ednc_installations`, `ednc_logs`** - 0 rows, and they belong to the eDNC
   tooling rather than the asset catalog. Skip.
@@ -482,7 +482,7 @@ if __name__ == "__main__":
     args = parser.parse_args()
 
     client = ImportClient(args.token, dryrun=args.dry_run)
-    # read legacy rows from prodscratch (read-only) and call the import_* fns
+    # read legacy rows from legacyshopdb (read-only) and call the import_* fns
     # in the order of section 2, keeping a legacy-id -> new-id map as you go.
 ```
 
@@ -497,7 +497,7 @@ need it to remap foreign keys (a machine's `businessunitid`, a checkout's
 After each phase, compare counts. Legacy side (read-only), for example:
 
 ```bash
-docker exec dev-mysql mysql -uroot -p"$MYSQL_ROOT_PASSWORD" prodscratch \
+docker exec dev-mysql mysql -uroot -p"$MYSQL_ROOT_PASSWORD" legacyshopdb \
   -e "SELECT COUNT(*) FROM vendors;"
 ```