docs: document llm.toml and llama-swap metadata discovery

README, CLAUDE.md and .env.example now point at llm.toml for LLM settings
(OPENROUTER_API_KEY stays in env) and describe the legacy env override
window, the discovered picker and the startup cross-check. ADR-0003 records
the move and amends ADR-0002's deployment-config home; CONTEXT.md's
Deployment config / Hard default entries follow. Source comments and the
"set LLAMA_SWAP_URL" error strings name the llm.toml keys.

Also fixes README's AGENTIC_MAX_ITERATIONS default (10 -> 12, what the
code uses).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CONTEXT.md

@@ -74,13 +74,14 @@ _Avoid_: user prefs, user settings, preferences (ambiguous with device-local cli
 
 **Deployment config**:
 Values the server needs before it can start serving — bind address, database path, media
-roots, the URLs used to build clients — plus every secret. Lives in `.env` only; changing
-it is a redeploy, by design.
+roots, the URLs used to build clients — plus every secret. Lives in `.env`, except LLM
+settings, which live in `llm.toml` (ADR-0003); secrets stay in `.env` only. Changing it
+is a restart, by design.
 _Avoid_: environment config, system config
 
 **Hard default**:
-The env/code fallback a request lands on when neither an explicit param nor a stored
+The config/code fallback (`.env`, `llm.toml` or a code constant) a request lands on when neither an explicit param nor a stored
 owner default supplies the field (e.g. backend `local`, persona `default`, reel span
-day). It is the floor under the owner-default layer: env changes keep working whenever a
+day). It is the floor under the owner-default layer: config changes keep working whenever a
 default column is NULL.
 _Avoid_: fallback value, env default