docs(updater): correct PaperMC UA/fixture overclaims, re-tier the boundary

An out-of-band curl of the live Fill v3 endpoint contradicted two claims the
previous commit shipped and surfaced a mis-tiering:

- User-Agent is NOT enforced: fill.papermc.io/v3/projects/velocity returned
  HTTP 200 to a bare curl UA. The comments claimed a generic UA "is refused"
  and the API "REQUIRES" a contact UA. Reword to what is true — PaperMC's usage
  policy asks for a descriptive UA and may block generic ones, but sending it is
  etiquette/defensive here, not a gate Felis depends on.
- The test fixture's shape was invented, not captured: the real "versions"
  object groups the entire 3.x line under a single key "3.0.0", not the
  per-minor keys the fixture used. Replace it with the real body (keys and
  version strings as returned). The key-agnostic parser already produced the
  right answer, and an independent max-stable check confirms 3.4.0.
- Re-tier doc.go: the GitHub Releases source is verifiable-here (the same
  httptest-testable shape as PaperMC), not integration remainder. It is why
  3 of 4 components report "latest unknown" today and is the next verifiable
  slice — the release-source work is only ~half done until it exists.

No production logic changed. WSL oracle: build + vet clean, internal/updater
10/10, full tree go test RC=0 (19 ok, 0 fail).

internal/updater/papermc.go

@@ -10,11 +10,15 @@ import (
 	"felis.lolicon.best/internal/updates"
 )
 
-// defaultUserAgent identifies Felis to the PaperMC Fill v3 API, which REQUIRES a
-// non-generic User-Agent that names the software and carries a contact URL — a
-// generic default (curl, wget, Go-http-client) is refused. It uses the public Felis
-// module path as the contact and contains no operator-specific serving domain; a
-// deployment can override it (paperMC.userAgent) with a SysAdmin contact from config.
+// defaultUserAgent identifies Felis to the PaperMC Fill v3 API. PaperMC's API usage
+// policy asks consumers to send a descriptive User-Agent that names the application
+// and carries contact info, and warns that generic/library-default agents (curl, wget,
+// Go-http-client) may be rate-limited or blocked. Enforcement was NOT active on the
+// project-metadata endpoint as of 2026-07-04 — a bare UA still returned HTTP 200 — so
+// sending this is documented etiquette and future-proofing, not an empirically
+// confirmed hard gate. It uses the public Felis module path as the contact and
+// contains no operator-specific serving domain; a deployment can override it
+// (paperMC.userAgent) with a SysAdmin contact from config.
 const defaultUserAgent = "felis-updater/0.1 (+https://felis.lolicon.best)"
 
 // paperMC discovers the latest STABLE version of a PaperMC project (Velocity, for
@@ -25,7 +29,7 @@ const defaultUserAgent = "felis-updater/0.1 (+https://felis.lolicon.best)"
 // network (see papermc_test.go, whose fixture is captured from the real v3 shape).
 type paperMC struct {
 	baseURL   string // e.g. "https://fill.papermc.io"
-	userAgent string // non-generic UA with a contact (Fill v3 requirement)
+	userAgent string // descriptive UA with a contact (PaperMC usage-policy etiquette)
 	hc        *http.Client
 }