[deckhouse-cli] fix mirror docs

[ldmonster]

What this PR does

Documentation only — no code changes. It adds first-time reference docs for two previously undocumented command trees and brings the mirror and plugins docs in line with the current implementation.

• d8 system — new internal/system/README.md (the command had no docs). Covers the whole tree: get/edit of the kube-system bootstrap Secrets, the module lifecycle (enable/disable/maintenance/approve/apply-now/values/snapshots), package scan, queue, logs, and collect-debug-info — with the three cluster-access paths and the leader=true pod requirement spelled out, plus a safety section.
• d8 status — new internal/status/README.md (also undocumented). Documents the read-only, nine-section cluster health report: the source resource and columns of each section, the credential masking in the settings section, prerequisites/RBAC, and that sections are independent/best-effort.
• d8 mirror — expanded internal/mirror/README.MD (+ PROXY-REGISTRY.md and docs/mirror-pull-dry-run.md). Adds Release Channel Selection (single-channel pulls, tag-pinned behaviour, suspended channels, LTS/CSE editions), VEX vulnerability-attestation images, package filtering/mirroring/selection, Security Databases, Editions, and multi-version pinning.
• d8 plugins — corrected and extended docs/plugins.md and internal/plugins/README.md (see fixes below).
• Top-level README.md — adds the missing status row to the command table and points system at its new README.

Why we need it

Two command trees (system, status) shipped with no reference documentation, and the plugins docs had drifted from the code — including a wrong RBAC role that would have led admins to bind the wrong ClusterRole. This aligns the docs with the implementation and fills the gaps, following the style of the existing internal/cr/README.md.

Notable correctness fixes (plugins)

• 403 ClusterRole was wrong. The doc told admins to bind d8:registry-packages-proxy:cli-download (the self-update role); the plugin download path requires d8:registry-packages-proxy:packages-download. Worth a reviewer confirming against the platform RBAC manifests.
• "There is no direct-registry path" was inaccurate. A hidden, temporary --source bypass exists (pulls straight from a registry, force-enables --skip-cluster-checks); now documented as such.
• Troubleshooting table corrected and completed — split 401/403, fixed the x509/endpoint-discovery attribution (it's the kube-API leg, not the proxy), and added the missing 5xx, endpoint-discovery, and cluster-unreachable rows.
• Requirements model extended: noneOf (forbidden modules), conditional plugin deps, and the cluster snapshot (three reads, lazy, cached, 30s timeout).