Ticket 6 — Docs: CMS vs fiscal media and M1/M2/M3 manager agenda

[jbagsik]

What to build

Package docs distinguish public CMS media from fiscal/private media, describe protection (mutate vs show vs download), API exclusion defaults, and record the open manager decision on ownership before any e-billing migration:

Option	Bytes	Search
M1	Media owns private bytes	Media library
M2	e-billing owns bytes; Media indexes/links	Media + e-billing
M3	e-billing owns bytes and search; Media stays CMS-only	e-billing only

Include discussion agenda: source of truth; CMS blast radius; one UI vs separate browser; retention years; delete authority; global vs dedicated search; API exclusion; backup under M1; harden-vs-decide order; scope of invoice XML/PDF, source PDFs, KoSIT/veraPDF installs and reports; portal customer download boundaries. Note engineering preference to discuss: M3 or M2 unless Media commits to first-class fiscal mode. Reference host ADR 0018; do not migrate e-billing in this epic.

Acceptance criteria

• README/CONTEXT (or package docs) describe CMS vs fiscal/private mode and protection/API behaviour as shipped in Tickets 1–3.
• M1/M2/M3 and the full manager agenda are written for decision-makers.
• Explicit: no e-billing path re-home until ownership is decided; private Spatie disk ≠ GoBD-complete alone.
• No host/customer brand naming in moox/media docs.