docs(readme): update for the hosted demo and fix the diagram on dark backgrounds

[nadeem4]

The diagram on dark backgrounds

The owner reads GitHub in dark mode, where the README's flowchart looked broken.

The cause, confirmed from GitHub's own bundle
(viewscreen.githubusercontent.com/static/assets/mermaidMarkdown-*.js):

const mode = document.querySelector("html")?.getAttribute("data-color-mode");
mermaid.initialize({ …, secure: ["secure","securityLevel","startOnLoad","maxTextSize"],
                     theme: mode === "dark" ? "dark" : "default" });

GitHub picks the theme from the reader. theme is not in its secure list,
so a diagram's own %%{init}%% overrides that choice — and ours pinned
lineColor: #000000 and primaryTextColor: #000000, which is black edges and
black edge-label text on GitHub's #0d1117 canvas.

Before, on GitHub dark: the boxes float unconnected — every edge and
arrowhead is invisible — and the retryable / refused / passed labels are
black text on a black label background. After: every node, edge, arrowhead
and label reads cleanly, in both themes.

The easiest way to confirm it is to view this diff in dark mode and then in
light mode. Emphasis is now carried by shape rather than colour: stadium for
the entry and the two terminal states, diamond for the decision.

How it was verified

A harness reproduced GitHub's initialize() call verbatim, against #ffffff
with data-color-mode="light" and #0d1117 with data-color-mode="dark", at
Mermaid 11.17.2 and 12.0.0 (the bundle is an 11.x — it carries treemap,
radar and kanban, and no version string of its own, so both majors were
checked). Eight renders, all inspected. Every node, label, edge and arrowhead
is legible in both themes at both versions.

The rule

CLAUDE.md now distinguishes the two cases in two lines: the fixed black-and-
white init line where we control the background (artifact, Notion, paper), and
no forced colours where the reader picks the theme. No test asserted the old
wording.

The docs site

mkdocs.yml has both a default and a slate palette, toggled by the reader —
neither carries a media: key, so the site does not follow the OS theme, but it
does have a dark mode. The two diagrams that carried the forced init
(docs/architecture/indexing.md,
docs/architecture/nodes/datasource_resolver_node.md) were stripped for
consistency, but the site was never affected: building the site and
screenshotting the indexing page in slate, with and without the init line,
gives pixel-equivalent, legible results. Material for MkDocs ships CSS that
restyles .mermaid SVGs from its own palette variables, and those rules win
over the inline attributes the directive produces. (mermaid2 itself
initializes with {} at Mermaid 10.4.0 — it is Material's CSS doing the work.)

README, checked against the code

Wrong, now fixed:

• Read-only. The README said connections "are not opened read-only on any
  dialect". SQLite datasources opt in with options.read_only: true → mode=ro,
  and all three sample databases do. No other dialect does — so a read-only
  database user is still the real control, and that is what it now says.
• The global planner. The decomposer builds the ExecutionDAG itself; there
  is no planner node. Also fixed the same stale claim in
  docs/architecture/pipeline.md.
• /api/v1/ready does not check the index either.
• result.status can also be "", when no sub-query ran.
• --max-cost is not parser-required; it exits 2 when missing.

Missing, now added:

• The hosted demo leads the README, with the link and the preview card, and
  the bring-your-own-key story: one key per provider, kept in the tab, used in
  memory, never stored/logged/traced; a model per step; read-only databases;
  rate limits.
• 13 pipeline steps, five decided by a model.
• The plan language: the function allow-list, portable DATE_PART/DATE_TRUNC
  rendered by each adapter, ordinal fields gone.
• The validator builds the generator's query tree, so an unjoinable plan is
  rejected where a retry can still fix it.
• Benchmark scoring: strict and lenient accuracy, 95% Wilson intervals,
  alt_gold_sql, the paired McNemar regression gate; 43 gold questions, 39
  answerable.
• REST response fields (trace_id, reasoning, artifact_refs, and the five
  missing sub-query fields), the facade's get_schema/index_health/
  inspect_retrieval/rebuild_index, ENV/ENV_FILE_PATH,
  EMBEDDING_MODEL, SCHEMA_STORE_PATH, the artifact vars, OpenRouter's
  default model, and --dataset/--export-path on the benchmark rows.
• CLAUDE.md and tests/architecture/test_boundaries.py in Contributing.

Limitations kept honest: no cross-database questions, no conversation,
read-only enforced for SQLite but a read-only database user still wanted, and
the hosted demo's rate limits explicitly best-effort (one process, and the
per-session cap hangs on a clearable cookie).

Mirrored into packages/nl2sql/README.md (PyPI), which stays shorter and
absolute-linked. The <!-- BENCHMARKS:START/END --> block was not touched.

Left alone

• docs/assets/screenshots/playground-overview.png predates the Pipeline nav
  (its tabs are Ask / Settings / Retrieval). Re-capturing needs the playground
  built and running, so the alt text was left describing what the image
  actually shows rather than claiming a tab that is not in it.
• No top-level nl2sql stats command exists — only nl2sql feedback stats,
  which the table already had.

Checks

Check	Result
pytest -m "not integration" -q	1589 passed, 5 skipped
EMBEDDING_PROVIDER=local pytest -m "integration and not llm" -q	72 passed, 3 skipped
mkdocs build --strict	clean

The 8 skips are pre-existing: langchain_anthropic is not installed locally.