docs: purge remaining Upstash references and sync to DO storage

Drop /admin/migrate-from-upstash from public API docs, replace deprecated
UPSTASH_* env vars with ALLOWED_ORIGINS/ENVIRONMENT, update Worker
conventions to reflect DO bindings (env.CANVAS_ROOM) instead of Redis
client patterns, and rewrite system-architecture security/data-flow
sections to cover cookie+IP identity, transactionSync atomicity, WS
Origin allowlist, per-identity WS cap, and broadcast sequence numbers.

.env.example

@@ -1,2 +1,5 @@
-UPSTASH_REDIS_REST_URL=
-UPSTASH_REDIS_REST_TOKEN=
+# No external secrets required.
+# Canvas + cooldown state live inside the CanvasRoom Durable Object (SQLite).
+# Configurable Worker vars (set via wrangler.json or `wrangler secret put`):
+#   ALLOWED_ORIGINS  - comma-separated WebSocket origin allowlist (empty = allow all)
+#   ENVIRONMENT      - "production" enables fail-closed identity resolution