docs: clarify CLI quickstart

[daniel-scrivner]

Scope

• Make the README start with installation, a contract-valid filing command, expected JSON result, docs, compatibility, and support.
• State the CLI's REST and hosted MCP posture plus x-api-key authentication.

Factual self-audit

• secapi filings latest --ticker AAPL --form 10-K, SECAPI_API_KEY, --api-key-stdin, and MCP setup commands were verified against this branch and current canonical docs.
• The expected result describes live fields only and does not promise a stable filing identity.
• No API behavior, package version, or package manifest changed.

GitHub metadata

• Applied description: Command-line client for source-backed SEC filings and financial data.
• Homepage remains https://docs.secapi.ai; added sec-filings topic.

Registry delta

• No npm publish attempted. Observed npm @secapi/cli@1.4.0 description and repository package.json description match, while both source and published homepage remain https://secapi.ai/developers.
• The README update is repository-only until the normal npm release owner publishes a new version.

Validation

• git diff --check
• Documentation-link HTTP checks
• Baseline failure recorded, unrelated to this README-only diff: bun run typecheck reports the installed @secapi/sdk-js is missing multiple members used by the CLI; bun test has 22 failures in situations, filing-event, and fund-letter command coverage. A focused situations test exits 1 before making its expected request.

Tracks OMNI-5503 under OMNI-5326.