docs: clarify JavaScript SDK quickstart

[daniel-scrivner]

Scope

• Make the README start with installation, a contract-valid filing request, expected result, docs, compatibility, and support.
• State the SDK's REST wrapper posture, hosted MCP boundary, and x-api-key authentication.

Factual self-audit

• SecApiClient, agentLatestFiling(), SECAPI_API_KEY, and x-api-key were verified against this branch and current canonical docs.
• The example records accession number, filing date, filing URL, and request ID; it does not promise a stable live filing.
• No API behavior, package version, or package manifest changed.

GitHub metadata

• Applied description: JavaScript and TypeScript SDK for source-backed SEC filings and financial data.
• Homepage remains https://docs.secapi.ai; added sec-filings topic.

Registry delta

• No npm publish attempted. Observed npm @secapi/sdk-js@1.3.0 description: JavaScript and TypeScript SDK for SEC filings, filing sections, financial statements, and ownership data.
• Repository package.json still says client and points its homepage to https://secapi.ai/developers; the published metadata is unchanged and needs the normal release owner/mechanism for reconciliation.

Validation

• bun test (117 pass)
• bun run typecheck
• git diff --check
• Documentation-link HTTP checks

Tracks OMNI-5503 under OMNI-5326.