docs: rewrite README as a user-facing overview

[nihaopaul]

Why

The README opened by calling itself a proof of concept and led with the Traefik WASM rationale, so a reader had to work out what the service actually does. This leads with that instead, in plain language: Traefik can't validate Cloudflare Access cookies itself, and this answers 200 or 403 on its behalf.

What's in it

• Request walkthrough — four steps from "user hits your app" to allow/deny, no Rust knowledge assumed.
• Background refresh intervals — public keys every 24h, application list every hour. Previously mentioned in passing; now stated as the reason you don't restart it when things change in Cloudflare.
• Configuration table, clarifying that CF_ORG is the Cloudflare account ID, which the variable name doesn't suggest.
• Compose example trimmed to variables that do something, with the :0.4.0 tag pinned instead of :latest.
• Traefik middleware + router wiring kept, since that's the part people actually copy.
• Build instructions via devbox run test / devbox run build, matching CI.

One thing newly documented

Every AUD in the account is accepted for every protected route: get_aud() returns the whole application list and hands it to set_audience(), so a token minted for one app validates against a route protected for another. Two apps behind a single instance can accept each other's tokens.

That's an architectural property rather than a defect, but it wasn't written down anywhere, and it's the kind of thing that changes whether you'd put this in front of a writable dashboard. Verified against the code rather than assumed.

Also noted that only linux/amd64 images are published, so arm64 hosts need emulation or a local build.

Trimmed from the supplied compose example

NVIDIA_VISIBLE_DEVICES, group_add, TZ, dns, healthcheck, privileged, stdin_open, tty, pull_policy and platform were dropped. They're either defaults, host-specific artifacts, or inert here — TZ in particular does nothing, since expiry checks use Unix timestamps and the distroless runtime carries no tzdata.

🤖 Generated with Claude Code