docs(examples): add the CMS proof-of-concept dogfooding artifact

A WordPress-inspired CMS whose entire backend is PiCloud Rhai scripts
deployed with pic apply, plus a SvelteKit frontend. Built to dogfood the
project tool, CLI, and SDK; exercises docs/kv/files/users, docs+queue+cron
+pubsub triggers, the transactional-outbox notification chain, a docs
before-interceptor, set_if CAS, SSE, per-app CORS, env overlays, and a
durable Workflow (validate -> enrich || seo -> publish -> finalize) started
with workflow::start and polled with workflow::run_status, visualized live
with Svelte Flow.

FINDINGS.md / SECURITY.md capture every gap, surprise, and security issue
found (each tagged [PiCloud] vs [CMS]); the platform fixes for the
actionable ones ship in the preceding commit.

Also folds in the read-only `pic` allowlist entries added to
.claude/settings.json during the session (fewer-permission-prompts).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

examples/cms-poc/run-server.sh

@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+# Boot the picloud all-in-one for the CMS PoC against the clean picloud_cms DB,
+# relaying email through the local Mailpit (docker) on :1025.
+# Postgres + Mailpit are expected up (docker compose up -d postgres; docker run ... mailpit).
+set -euo pipefail
+cd "$(dirname "$0")/../.."   # repo root
+
+export DATABASE_URL="postgres://picloud:picloud@127.0.0.1:15432/picloud_cms"
+export PICLOUD_BIND="0.0.0.0:8081"
+export PICLOUD_DEV_MODE=true
+export PICLOUD_DEV_INSECURE_KEY="i-understand-this-is-insecure"
+export PICLOUD_ADMIN_USERNAME=admin
+export PICLOUD_ADMIN_PASSWORD=admin
+export PICLOUD_PUBLIC_BASE_URL="http://localhost:8081"
+# --- SMTP relay -> Mailpit (all three of HOST/USER/PASSWORD required; TLS=none for Mailpit) ---
+export PICLOUD_SMTP_HOST=127.0.0.1
+export PICLOUD_SMTP_PORT=1025
+export PICLOUD_SMTP_USER=cms
+export PICLOUD_SMTP_PASSWORD=cms
+export PICLOUD_SMTP_TLS=none
+export RUST_LOG="${RUST_LOG:-info,picloud=info,manager_core=info}"
+
+exec ./target/debug/picloud