docs: close shipped GitHub issues and refresh README status

[degoke]

This agent token cannot close GitHub issues directly (issues:write is not granted). Merging this PR uses GitHub closing keywords so the already-shipped issues close automatically.

Close (already on main)

Issue	Merged work
#8 API security / authz test suite	#33 — pkg/testkit/authztest (58 scenarios), HTTP authz E2E, examples/smart-authz
#20 SMART 2.2 granular scopes	#33 — CRUDS + ?param= filters, permission-v2.2
#9 Bulk Data / analytics / SQL-on-FHIR	#36–#38, #41, #56, #57
#17 Runtime IG & terminology platform	#34, #39, #40
#23 Built-in OAuth/SMART AS	On main via #33 / #54; pkg/oauth + examples/smart-oauth
#27 StructureMap SDC extraction	#32, #47

Closes #8
Closes #9
Closes #17
Closes #20
Closes #23
Closes #27

Leave open (not done)

Issue	Why
#10 Proof-of-conformance/scale harness	No benchmark suite yet
#11 Research contributions	Tracking research, not a shipped feature
#22 Inferno SMART App Launch kit	Full test-kit Docker still deferred (Go smoke tests exist)
#26 CQL execution library	Still an adapter interface; no runtime
#42 INT96 Parquet date writer	Documented spec deviation
#46 Streaming BlobStore upload	Still O(file) at parquet upload

Also stale (not closed by this PR)

• Draft #19 duplicates API security: SMART 2.2 readiness and authorization semantics test suite #8 and was superseded by SMART 2.2 granular scopes and authorization test suite (#8, #20) #33.
• Draft #48 is leftover haistack serve OAuth wiring; the pkg/oauth: built-in OAuth2/SMART authorization server for self-contained deployments #23 authorization server itself is already on main.

Docs change

README project status, package table, and roadmap notes now list oauth, structuremap, testkit, SMART 2.2, and production patient-scope checks as done.