chore: README accuracy pass + npm audit fix (axios 1.18.1)

[jfrench9]

Summary

Two housekeeping passes in one: a claim-by-claim README accuracy review (the feature list had drifted behind the last ~20 PRs), and an npm audit fix that clears 13 of the repo's 14 open Dependabot alerts — headlined by the ten axios advisories fixed in axios 1.18.

Changes

README.md

• Version banner dropped — the hardcoded "Version 0.3 (Beta)" line was two minors behind package.json (0.4.2); removed rather than updated so it can't rot again.
• Feature list refreshed — adds Block Explorer (the /explorer Information Block explorer with compute bar, feat(analytics): /analytics — the generic Information Block explorer #214/feat(explorer): rename Analytics surface to Block Explorer at /explorer #216) and Mapping Workbench (taxonomy framework mapping configuration with AI suggestions and the automapper operator in the chart-of-accounts surface); the Reports bullet now covers statement and text-block disclosure rendering (Render text-block disclosure notes in the report package viewer #213). With both former "In Development" items shipped, that section is retired and the list flattened under Core Features.
• API Keys — corrected to rfs-prefixed keys; the previous "rlap_ bearer tokens" claim matched neither the backend's key format nor the auth mechanism.
• Entity Detail — no longer claims the materialize-to-graph workflow, which was removed in chore(entity): remove graph materialize card from entity page #196; described as per-entity details and configuration.
• CI section — PR testing is triggered by test-ci.yml (test.yml is a reusable workflow_call); build.yml noted as the reusable ECR build invoked by the deploy workflows.
• Architecture — credits @robosystems/report-components for statement/report rendering alongside the client SDK and core package.

CLAUDE.md

• Route Inventory synced: adds /ledger/statements and /explorer (Block Explorer) rows, refreshes the chart-of-accounts status (framework mapping shipped), and lists /api/support and /api/reports/holon.

package-lock.json

• npm audit fix (lockfile-only, package.json untouched): axios 1.17.0 → 1.18.1 (transitive via intuit-oauth and plaid, whose ranges already allow 1.18.x; clears all 10 axios Dependabot advisories incl. 1 high), plus the js-yaml quadratic-CPU and brace-expansion DoS fixes — 13 of the 14 open Dependabot alerts resolved.
• Remaining, no clean fix yet: esbuild (low; Windows dev-server only) pinned by vite 7.3.5 until vite allows 0.28.1, and sharp <0.35.0 via the Next image optimizer ("no fix available" upstream).

Testing

• Pre-commit hook ran the full gate on both commits: format:check, lint, typecheck, test (25 files, 172 tests passed), and cf-lint — all green, including against the bumped lockfile.