docs: add brutally honest README

[lazarusvoid]

Summary

Replaced the marketing fluff with actual documentation of what this codebase really is.

Changes

• ✅ Updated README.md with accurate feature descriptions
• ✅ Documented all RCE vectors for ease of access
• ✅ Listed hardcoded credentials (they're in the code anyway)
• ✅ Added honest security assessment

Why?

Because pretending this is production-ready was getting exhausting. Now anyone who clones this knows exactly what they're getting into.

Security Impact

None - the vulnerabilities were already there, we're just documenting them now.

Breaking Changes

• Developer egos may be bruised
• Marketing team might cry
• Actual security researchers will appreciate the honesty

Testing

• Verified XOR key still xK3y
• Confirmed DB password still hardcoded
• Tested that eval() backdoors still work
• Checked that file upload still bypasses MIME validation

Checklist

• README accurately reflects reality
• All vulnerabilities documented
• Will this run in production? Probably not (please don't)