docs: take one site's name, hosts and paths off the public wiki

The publishability gate caught internal tooling names and developer paths but
nothing site-specific, so roughly sixty leaks reached the wiki: the site name in
ten documents, real fleet hostnames in the collector and GE-Enforce examples, an
internal database name through the whole import guide, imaging-share paths, and
a maintainer's username as the Deciders line of every ADR and inside a generated
curl example.

None of it is a security matter on an air-gapped fleet. It matters because these
pages are read by engineers at other plants, and a document that names one site
throughout reads as that site's notes rather than a product's documentation -
which is exactly what it then gets treated as.

Examples now use neutral hostnames, the site is "the reference site" where the
distinction carries meaning, and ADRs are decided by "ShopDB maintainers". The
gate carries all of these patterns, so the next one fails a build.

Two documents leave docs/ because they were never written for an outside reader.
PROJECT-REVIEW.md is an internal health memo pinned to a commit from July, whose
headline finding (an untracked playbook) has since been fixed - it is history,
and git holds it. PILOT-DEPLOY.md is one site's own cutover runbook, complete
with a "re-measure before publishing" placeholder; it moves next to the loader
it belongs to, in scripts/site_imports/wjf/.

ADR-015 is AMENDED rather than rewritten. Its enforcement section still said
report-only and its backlog still listed hardcodes that are now cleared, which
left the record contradicting itself. The amendment says what changed and why
the report-only period ended; the original text stays, because what the decision
looked like when it was taken is the part worth keeping.

Also corrects llms.txt's response envelope, which had errors at the top level
and pagination at meta.total. Both are nested one deeper, so anything written
against that description read undefined on every error it tried to handle.

docs/llms.txt

@@ -49,7 +49,8 @@ Do NOT hand-write CSV templates - generate them. User accounts are deliberately
 not CSV-importable.
 
 ## Base URL
-Prod (West Jefferson): `https://shopdb.example.net/shopdb`
+Each site runs its own instance (ADR-004), so there is no single production URL:
+it is whatever that site serves, e.g. `https://shopdb.example.net/shopdb`.
 All API paths are under `/api` (e.g. `<base>/api/assets`). Dev: `http://localhost:5001`.
 
 ## Auth
@@ -70,9 +71,12 @@ Auth level per endpoint is in the OpenAPI `security` field: `bearerAuth`,
 
 ## Response envelope
 JSON endpoints return `{ "status": "success", "data": <payload>, "meta": {...} }`.
-Errors: `{ "status": "error", "message": "...", "code": "..." }` with an HTTP 4xx/5xx.
-Lists include `meta.total` / pagination. A few feed endpoints (screensaver, some
-installer text formats) return raw text/JSON without the envelope - noted per route.
+Errors nest under `data`, NOT at the top level:
+`{ "status": "error", "data": { "error": { "code": "...", "message": "...", "details": {...} } } }`
+with an HTTP 4xx/5xx. Reading `message` or `code` off the root gives `undefined`.
+Lists carry `meta.pagination.{page, perpage, total, pages}` - again nested, not
+`meta.total`. A few feed endpoints (screensaver, some installer text formats)
+return raw text/JSON without the envelope - noted per route.
 
 ## Common recipes
 - Search everything: `GET /api/search?q=<term>` (multi-word = AND across words).
@@ -96,6 +100,7 @@ installer text formats) return raw text/JSON without the envelope - noted per ro
 - Plugin endpoints live under the plugin's prefix (`/api/<plugin>/...`).
 
 ## Full reference
-- Machine spec: `GET /api/docs/openapi.json` (OpenAPI 3.1, 362 operations).
+- Machine spec: `GET /api/docs/openapi.json` (OpenAPI 3.1). Operation and
+  plugin counts live in `docs/PROJECT-MAP.md`, which is generated.
 - Interactive: `GET /api/docs` (Redoc).
 - Human reference: `docs/API-REFERENCE.md`.