docs: sync SKILL.md + llms-cli.txt to db(req) / adminDb() dual surface

[MajorTal]

Mirrors run402-private#51 (functions-sdk-caller-context). Layer run402-functions-runtime:10 + SDK v1.1.0 are live in production; these public docs need to describe the shipped contract.

Changes

SKILL.md (DB access inside functions)

• Two explicit clients now: db(req).from(table) (caller-context, RLS applies, routes /rest/v1/*) and adminDb().from(table) (BYPASSRLS, routes /admin/v1/rest/*).
• db.sql renamed to adminDb().sql (always BYPASSRLS — no caller-context SQL path).
• Added short "when to use which" guidance — default to db(req); reach for adminDb() only when the function is the principal (audit logs, webhook handlers, cron cleanup).
• Legacy db.from(...) / db.sql(...) flagged as a one-release deprecation shim that warns on first use and routes through adminDb().

cli/llms-cli.txt (Functions section)

• Same restructure, plus refreshed runnable examples that use db(req) for user-scoped reads/writes and adminDb() for admin paths.
• Static-site-generation guidance updated to point adminDb().from() at build time.

openspec/specs/functions-db-docs/spec.md

• Requirements rewritten around the dual-surface model so validation tracks the new contract (no more "db.from() uses service_role and bypasses RLS" — that's now the opt-in).

Why now

Gateway rejects role=service_role on /rest/v1/* as of PR #51. Any agent reading the old public docs would write a function that gets 403s in production. This PR closes that gap.

Test plan

• rg 'db\\.from|db\\.sql' in SKILL.md and cli/llms-cli.txt only matches the deprecation-shim callout
• Both files reference db(req) and adminDb() with matching routes (/rest/v1/* and /admin/v1/rest/*)
• Private-repo prod E2E 258/258 after step-17 alignment — this docs PR describes what that test now asserts

Follow-ups

• Next SDK release (run402-functions 1.2.0) removes the legacy db.from / db.sql shim. Update these docs again to drop the deprecation callout at that time.

🤖 Generated with Claude Code