docs: mount applications from the root config; correct isolation claims

Addresses the outstanding review on #586, updated for #612 (root-config
application mounts).

- Routing: make the root `harper-config.yaml` application entry the
  primary mount (`host`/`urlPath`), with `deploy_component` as the
  deploy-time equivalent and `server.http(handler, { host, urlPath })` as
  the programmatic one. Branching on `request.host` is now reserved for
  genuinely custom dispatch. Adds a v5.2.0 badge.
- Adds "What a mount does not do": a mount is not a resource namespace
  (exports land in one instance-wide registry, so duplicate resource
  names still conflict), and it does not host-constrain `fastifyRoutes`
  (a host-mounted app declaring them fails to load). Drops `fastifyRoutes`
  from the primary config example; plugin `urlPath` now positions a plugin
  within the app, composing with the mount.
- Data: renamed to "Namespacing data by database" and states plainly that
  a database is a namespace, not an enforced boundary — every co-located
  component can reach any database through the shared `databases` object,
  and buggy or untrusted code is not prevented from crossing it. Real
  isolation requires a separate instance or cluster.
- Roles: replaced the per-application enforcement claim with the shared
  model — every `roles.yaml` reconciles into the instance-wide role
  registry (same name = same role, last load wins), users and sessions are
  instance-wide. Recommends application-prefixed role names with
  permissions scoped to each application's database.
- Replaces the deprecated `runFirst` option in the middleware example with
  the `name`/`before`/`after` ordering guidance.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: BboyAkers