docs(examples): add the CMS proof-of-concept dogfooding artifact

A WordPress-inspired CMS whose entire backend is PiCloud Rhai scripts
deployed with pic apply, plus a SvelteKit frontend. Built to dogfood the
project tool, CLI, and SDK; exercises docs/kv/files/users, docs+queue+cron
+pubsub triggers, the transactional-outbox notification chain, a docs
before-interceptor, set_if CAS, SSE, per-app CORS, env overlays, and a
durable Workflow (validate -> enrich || seo -> publish -> finalize) started
with workflow::start and polled with workflow::run_status, visualized live
with Svelte Flow.

FINDINGS.md / SECURITY.md capture every gap, surprise, and security issue
found (each tagged [PiCloud] vs [CMS]); the platform fixes for the
actionable ones ship in the preceding commit.

Also folds in the read-only `pic` allowlist entries added to
.claude/settings.json during the session (fewer-permission-prompts).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

examples/cms-poc/scripts/media/media_get.rhai

@@ -0,0 +1,18 @@
+// GET /cms/media/:id — serve the image as REAL binary bytes (public).
+// Since the platform fix (F-026), a response with a `body_base64` field returns
+// raw bytes with a script-set Content-Type, so <img src="/cms/media/:id"> works
+// directly (no more base64 data-URL workaround).
+let id = ctx.request.params.id;
+let media = files::collection("media");
+let meta = media.head(id);
+if meta == () { return #{ statusCode: 404, body: #{ error: "not found" } }; }
+let bytes = media.get(id);
+if bytes == () { return #{ statusCode: 404, body: #{ error: "not found" } }; }
+#{
+    statusCode: 200,
+    headers: #{
+        "content-type": meta.content_type,
+        "cache-control": "public, max-age=3600",
+    },
+    body_base64: base64::encode(bytes),
+}

examples/cms-poc/scripts/media/media_upload.rhai

@@ -0,0 +1,43 @@
+// POST /cms/admin/media — upload an image (author+). Two ways in, since the
+// platform fix (F-026):
+//   1. JSON:      { name, content_type, data_base64 }
+//   2. RAW BINARY: Content-Type: image/png, body = the bytes, ?name=file.png
+//      (the platform hands a non-JSON binary body to the script as base64).
+// SVG is rejected (it can carry scripts -> stored XSS).
+import "auth" as auth;
+let g = auth::guard(ctx, ["admin", "author"]);
+if !g.ok { return g.response; }
+
+let allowed = ["image/png", "image/jpeg", "image/gif", "image/webp"];
+let name = ();
+let content_type = ();
+let bytes = ();
+
+let b = ctx.request.body;
+if type_of(b) == "map" {
+    // (1) JSON path
+    if b.data_base64 == () || b.name == () || b.content_type == () {
+        return #{ statusCode: 400, body: #{ error: "name, content_type, data_base64 required" } };
+    }
+    name = b.name;
+    content_type = b.content_type;
+    bytes = base64::decode(b.data_base64);
+} else if type_of(b) == "string" {
+    // (2) raw binary path — body is the platform's base64 of the raw bytes
+    let ct = ctx.request.headers["content-type"];
+    if ct == () { return #{ statusCode: 400, body: #{ error: "content-type header required" } }; }
+    content_type = ct;
+    name = ctx.request.query["name"];
+    if name == () { name = "upload"; }
+    bytes = base64::decode(b);
+} else {
+    return #{ statusCode: 400, body: #{ error: "empty body" } };
+}
+
+if !allowed.contains(content_type) {
+    return #{ statusCode: 415, body: #{ error: "unsupported content_type (images only, no svg)" } };
+}
+
+let media = files::collection("media");
+let id = media.create(#{ name: name, content_type: content_type, data: bytes });
+#{ statusCode: 201, body: #{ id: id, name: name, content_type: content_type, size: bytes.len() } }