docs(devices): explain onboarding and security model

[ericshang98]

Summary

• restructure the public Quickstart around the device–Host–Agent architecture
• distinguish supported first-party onboarding from public DIY SDK enrollment
• add a machine-readable availability source and an exact XIAO reference-controller guide
• document BLE, authorization, minimum-disclosure, voice, revocation, and production security boundaries

Verification

• deterministic private-to-public export and --check
• public SDK reference, script, firmware, boundary, and naming tests
• website SDK documentation contracts against the merged canonical source

Canonical private source: ericshang98/pinclaw-dev#417