docs(examples): add the CMS proof-of-concept dogfooding artifact

A WordPress-inspired CMS whose entire backend is PiCloud Rhai scripts
deployed with pic apply, plus a SvelteKit frontend. Built to dogfood the
project tool, CLI, and SDK; exercises docs/kv/files/users, docs+queue+cron
+pubsub triggers, the transactional-outbox notification chain, a docs
before-interceptor, set_if CAS, SSE, per-app CORS, env overlays, and a
durable Workflow (validate -> enrich || seo -> publish -> finalize) started
with workflow::start and polled with workflow::run_status, visualized live
with Svelte Flow.

FINDINGS.md / SECURITY.md capture every gap, surprise, and security issue
found (each tagged [PiCloud] vs [CMS]); the platform fixes for the
actionable ones ship in the preceding commit.

Also folds in the read-only `pic` allowlist entries added to
.claude/settings.json during the session (fewer-permission-prompts).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

examples/cms-poc/scripts/auth/bootstrap.rhai

@@ -0,0 +1,25 @@
+// POST /cms/auth/bootstrap — create the first admin/author account.
+// Gated by the `setup-token` secret (compared server-side; never echoed).
+// This exists because there is no CLI/API to grant an app-user a role —
+// role assignment is script-only (users::add_role). See FINDINGS.
+let b = ctx.request.body;
+if b == () || b.setup_token == () {
+    return #{ statusCode: 400, body: #{ error: "setup_token required" } };
+}
+let want = secrets::get("setup-token");
+if want == () {
+    return #{ statusCode: 500, body: #{ error: "server not configured for bootstrap" } };
+}
+if b.setup_token != want {
+    return #{ statusCode: 403, body: #{ error: "bad setup token" } };
+}
+if b.email == () || b.password == () {
+    return #{ statusCode: 400, body: #{ error: "email and password required" } };
+}
+if !users::email_available(b.email) {
+    return #{ statusCode: 409, body: #{ error: "email already registered" } };
+}
+let u = users::create(#{ email: b.email, password: b.password, display_name: b.display_name });
+users::add_role(u.id, "admin");
+users::add_role(u.id, "author");
+#{ statusCode: 201, body: #{ id: u.id, email: u.email, roles: ["admin", "author"] } }