docs(readme): rewrite both READMEs to be short and accurate

[fylorn]

Summary

Rewrites README.md and README.zh-CN.md (375 and 243 lines, now 124 each) to lead with what ThinkWatch does for an organization:

• MCP tool calls run under each user's own upstream identity
• Security guards: PII redaction with restore (streaming included), tool-call inspection, hidden characters, content filter
• SSO/OIDC, TOTP, RBAC
• One tw- key for AI and MCP
• Rate limits and budgets on users, API keys and roles
• Cost accounting (cost centers, CSV chargeback, forecast)
• ClickHouse audit trail with SIEM forwarding
• One endpoint for all four API formats, weighted/latency/health routing, circuit breaker

Kept: badges, architecture sketch, the exact quick-start commands, deployment options, doc links, license summary with the BSL 1.1 thresholds unchanged, the Core relation, and a one-line pointer to Lite. Spec-sheet material that thinkwat.ch/docs already covers (hardening headers, metrics, health endpoints, tech stack, project tree) is removed. Behaviour the docs do not cover is kept in a short "Behaviour worth knowing" section.

Corrections against the code

• Core dependency is four crates (tw-bedrock added), not "exactly three".
• Limits and budgets attach to user and api_key_lineage (plus role constraints folded into the user); the old provider / MCP-server / team subject table did not match crates/common/src/limits/mod.rs.
• PII placeholders are restored in streamed answers too (proxy/shaper.rs, FrameRestorer); the old "streaming does not restore" note was stale.
• OpenAI streams no longer need stream_options.include_usage from the client; the gateway requests usage itself (proxy/generate.rs).
• Weighted tokens come from input_weight / output_weight against the platform baseline price; input_multiplier / input_price no longer exist.
• There is no retry-with-exponential-backoff in the gateway (non-streaming requests fail over to another route instead); the claim is dropped.
• MCP Store ships 36 templates (was "23+"); the Chinese secret-rotation page exists now.
• The fail-open metric is lifecycle_rate_limiter_fail_open_total, not gateway_rate_limiter_fail_open_total (dropped from the README).

🤖 Generated with Claude Code