Fixes the highest-leverage findings from the full docs audit (110 guide
pages reviewed against a customer-comprehension rubric).

Contradiction fixes (docs said two different things, or taught dead APIs):
- OWD: permissions-matrix table/example/callout now use the canonical four
  sharingModel values (ADR-0090 D4) instead of removed legacy aliases
- referenceFilters taught as a positive example while relationships.mdx
  documents it as schema-accepted-but-inert — fields.mdx now teaches
  structured lookupFilters + dependsOn; property tables mark it Legacy
- percent semantics unified to fraction storage (0.85 = 85%) across
  fields/decision-tree (validation-rules already had it right)
- hook input shape unified to the `{ doc }` contract (plugins tutorial
  handler + test now match kernel/events.mdx)
- libsql:// removed from self-hosting env table (driver ships in Cloud,
  not the open framework); backup page Turso section qualified
- api/index MCP row: actions require the author's ai.exposed opt-in
- permission-metadata: `positions` (not `roles`) is the canonical field
- common-patterns: all pattern objects now declare sharingModel and the
  page warns about namespace prefixes — examples pass the gate they teach

Key handovers (previously undocumented dead-ends):
- build-with-claude-code: seeded dev admin credentials at the verify step,
  npx os invocations, localhost MCP connect example
- api/index: new Authentication section (session sign-in + API keys)
- self-hosting: "First boot: create the admin" section (first signup =
  bootstrap admin); fixed dead examples/docker links (also docker/README)
- vercel: warn that InMemoryDriver loses data on every cold start
- getting-started prerequisites: Node 18+ only for the scaffold path
- kernel/services-checklist: stale-status warning banner
- quick-reference: unlink two non-existent reference pages

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>