docs: state the TLS posture, document the tuning environment variables, and give overload a doc.go

[FumingPower3925]

Summary

Documentation only, plus moving one package comment into its own file. This covers the README half of #415 and two of #418's three items.

Refs #415, #418

Changes

• TLS posture (Document the TLS posture #415).
  • The README's TLS line now says celeris is cleartext by design and TLS terminates at the edge.
  • It shows the in-process route that works today: Engine: celeris.Std plus StartWithListener(tls.NewListener(ln, cfg)). I checked it at 5b2e83b with a throwaway program on the std engine: status 200, HTTP/1.1, c.Scheme() == "https", c.IsTLS() == true.
  • The Database drivers section says what each driver does when TLS is asked for. Postgres returns ErrSSLNotSupported for require/verify-ca/verify-full, and prefer/allow connect in plaintext with a stderr warning (driver/postgres/dsn.go CheckSSL). Redis rejects rediss:// (driver/redis/client.go). Memcached has no TLS option.
  • Both point at TLS: engine-side termination + driver-side #446.
• Tuning environment variables (Docs gaps: tuning env vars, recovery, overload doc.go #418). A new table under Engine selection lists every tuning variable, as the code reads it at 5b2e83b:
  • CELERIS_ADAPTIVE_START only chooses the start engine (chooseStartEngine is its sole reader). It does not turn off switching, although the adaptive package comment and the docs site say it does.
  • CELERIS_MAX_IOURING_TIER treats any unrecognised value, including a typo, as none, and at none the io_uring engine refuses to start (probe/probe.go parseTierName, engine/iouring/engine.go).
  • CELERIS_IOURING_SEND_ZC=on cannot enable SEND_ZC where the startup probe failed (resolveSendZCPolicy).
  • CELERIS_IOURING_PBUF_COUNT is used only with multishot recv. The code rounds it up to a power of two and clamps it to 1024-32768. The default is effectively 1024: the auto formula is 2 x defaultConnsPerWorker (20), which is below the 1024 minimum.
  • CELERIS_IOURING_FIXED_FILES gets a do-not-set row (io_uring: fixed-file support is unimplemented behind a malformed accept SQE — readiness checklist before it can be enabled #541).
• Feature matrix. Provided buffers are opt-in together with multishot recv: the buffer ring is created only under CELERIS_IOURING_MULTISHOT_RECV=1 (engine/iouring/worker.go). The ring size is 1024 per worker, not "auto-scaled".
• middleware/overload/doc.go (Docs gaps: tuning env vars, recovery, overload doc.go #418). This was the only middleware package without one. The move changes no text: go doc -all output is byte-identical before and after.

Deliberately not in this PR

These wait until the #657 fix PRs have landed, because they touch adaptive/ and engine/iouring/:

• engine/iouring/doc.go says CELERIS_IOURING_PBUF_COUNT values "are clamped to [16, 32768]" and that non-power-of-two values "cause ring registration failure". Both are wrong at 5b2e83b: the code rounds up and clamps to [1024, 32768].
• The same file says the SEND_ZC default is "pending … celeris#465", but io_uring: probeSendZC can never detect copy-fallback — SEND_ZC enabled on every host regardless of NIC #465 is closed.
• The adaptive.Engine comment says CELERIS_ADAPTIVE_START "disables the runtime switch".

The docs-site half of #415 and #418 goes to goceleris/docs: the missing recovery row in the middleware catalog, the same CELERIS_ADAPTIVE_START claim in engines.md, and the std-engine HTTPS route in deployment.md.