docs: clarify safe local env setup

[b1rdmania]

Summary

• surface the existing safe local testing guidance earlier in the README
• recommend disposable Supabase/R2/model-provider resources and synthetic documents for first runs
• split frontend env examples into browser-safe public vars and server-side Next runtime vars
• clarify that SUPABASE_SECRET_KEY must never be exposed as a NEXT_PUBLIC_* value

Validation

• git diff --check

Documentation-only change.