Align README and running-the-server.md with the Docker-only policy (B-44)

CLAUDE.md declares the server always runs via Docker (dev and prod
alike) with no supported bare-uvicorn workflow, but README's Quick
start and docs/running-the-server.md's "Locale / venv" section still
documented running uvicorn directly — a leftover from before that
policy was adopted. Rewrite both to a single Docker-only path and
update CLAUDE.md's own note about it.

Verified docker compose run --rm app python scripts/generate_master_key.py
against a real build/run to confirm the Quick start's Docker commands
actually work as documented.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

tests/unit/test_docs_no_bare_uvicorn.py

@@ -0,0 +1,18 @@
+"""B-44: README and docs/running-the-server.md must not document a bare
+`uvicorn --reload` workflow — the server always runs via Docker, in dev and
+production alike (CLAUDE.md's "Commands" section), and the two files had
+drifted back to contradicting that policy."""
+
+from pathlib import Path
+
+REPO_ROOT = Path(__file__).parent.parent.parent
+
+
+def test_readme_has_no_bare_uvicorn_command():
+    readme = (REPO_ROOT / "README.md").read_text()
+    assert "uvicorn app.main:app --reload" not in readme
+
+
+def test_running_the_server_doc_has_no_bare_uvicorn_command():
+    doc = (REPO_ROOT / "docs" / "running-the-server.md").read_text()
+    assert "uvicorn app.main:app --reload" not in doc