docs: add trusted-peer sharing and peer-onboarding guides

[bkrabach]

Summary

Adds two operational guides for sharing a self-hosted context-intelligence server with trusted external peers over an overlay network (Tailscale), plus a README link section.

What's included

docs/remote-access-sharing.md (operator guide):

• Loopback binding to isolate the server to localhost only
• Exposing only the /events path via tailscale serve for HTTPS
• Per-peer access scoping with ACL grants (autogroup:member for your tailnet, explicit peer emails for shared users)
• Critical ACL pitfall: a default src:["*"] allow-all grant includes shared/invited users and grants are additive (union), so a narrow grant is cosmetic until the broad rule is changed to autogroup:member
• Network verification gates (bind isolation, auth rejection, path-rewrite correctness, end-to-end HTTPS)
• Cold backup with docker stop (not pause) and restore-as-root-in-a-container (resolves file ownership issue)
• Trust-model table documenting accept-or-harden decisions (single shared key, client-set workspace, no rate cap)

docs/peer-onboarding.md (peer-facing connect guide):

• What to expect (Tailscale device share, API key configuration)
• Step-by-step connection (accept share, install Amplifier bundle, set environment variables, verify)
• Scope of access (only the ingestion endpoint, no admin/Neo4j interfaces)

References (not duplication)

Both docs reference rather than repeat:

• The existing "Network Access and Security" section in README
• docs/service-setup.md §10 (Caddy/TLS patterns)
• The API-key bearer-token auth model already documented

Scope

• Docs-only PR — no application code changes, no config changes, low CI risk
• Generalized from a real deployment — all environment-specific values stripped (no tailnet IPs, node names, or keys)
• A CLA bot comment is expected and fine

Next steps

This can be merged as-is, or flagged for any wording/structure feedback.