docs: fix stale facts and plain up user-facing prose

[lesnik512]

Pass over the README, docs site, demos, SECURITY.md and the contributing guide.

Facts fixed

• Pages that listed only retry and bulkhead now cover the circuit breaker, keyed breaker and timeout (resilience intro, middleware intro, observability, several "See also" lists).
• errors.md called AsyncRetry "the default"; clients start with no middleware.
• The phase-decorator recipe said a middleware placed before AsyncRetry re-runs on every attempt. AsyncRetry resends the same request object, so the outer middleware runs once per call.
• The same recipe's event_hooks note registered the decorated function as a hook; it now says to use the undecorated function on a caller-built httpx2_client.
• Pitch is consistent across README, docs index and the pyproject description; the contributing guide no longer calls httpware async-only.
• Docs install section lists the [otel] and [all] extras.
• Removed internal details from user pages (_emit_event, _internal/redaction.py, the AGENTS.md admission check) and version-history wording ("0.6.0", "current behavior").
• The Code of Conduct sentence links the org's CODE_OF_CONDUCT.md.

Prose

Removed em dashes from prose, bold list labels, ALL-CAPS emphasis, dramatic one-line closers and curly quotes; headings and nav labels are sentence case. Demo walkthrough text is rewritten, including two strings in engine.js. index.md is reordered (first request, typed responses, resilience, streaming, then client options) without moving content to a new page, so inbound anchors still resolve.

Outside docs

• The streaming-body refusal note in retry.py now reads httpware: not retrying because the request body is a stream that cannot replay across attempts. Tests match on substrings and are unchanged; callers matching the exact note text would see the difference.
• pyproject.toml description: "Typed, resilient HTTP clients for Python, sync and async".

Verification

just lint-ci, just test (955 passed), just docs-build (strict, no warnings), just adr-check.