docs: correct command reference, fill security/config gaps, cut 2.1.0

[sakebomb]

Publish-readiness documentation pass from the docs audit, ahead of a Modrinth/Hangar release. Every claim was re-checked against the code.

Summary

• README "Extra commands" was actively wrong — it listed ~15 commands under names that don't exist (bare/poll* forms carried over unchanged from the upstream README); each returns Fail if copied. Rewritten against the real command registry (world.spawnEntity, events.projectile.hits, player.events.*, …), and documents getAbsPos/setAbsPos and the per-player setPlayer token.
• README publish-readiness — adds a Quickstart (install jar from Releases + pip install + a 5-line example) so non-source users have a path; the "Libraries" section now points at the bundled src/main/resources/mcpi instead of the archived upstream repo; adds player-tokens to Config; cross-links CONTRIBUTING/CHANGELOG.
• CHANGELOG — adds per-player setPlayer tokens (setPlayer(name) performs no ownership check — per-player authorization for binding/observation #47), brute-force lockout (Rate-limit setPlayer token attempts (brute-force lockout) #51), owner-scoped entity removal + bounded socket I/O (fix: gate entity removal by ownership and cap socket I/O (security) #54), and client token redaction (fix: keep auth tokens out of client errors, close socket on failed auth #55); cuts [Unreleased] as [2.1.0].
• SECURITY.md — documents the three previously-undocumented mitigations (per-session entity ownership incl. bulk removal, max-blocks-per-tick, enable-op-commands), the new bounded socket I/O, and the setPlayer lockout.
• Version bump 2.0.0 → 2.1.0 across pom, plugin.yml, client pyproject/__version__, and the bug-report template.
• plugin.yml: startup: postworld → load: POSTWORLD — startup is not a recognized Bukkit plugin.yml key (silent no-op); load is the real load-order directive. Behaviorally a no-op (POSTWORLD is already the default) but now correct and explicit.

Test plan

• ./mvnw test — 127 Java tests pass (plugin still loads under MockBukkit with load: POSTWORLD)
• pytest client — 25 client tests pass
• ./mvnw package builds raspberryjuice-2.1.0.jar
• Command names in the rewritten README verified against buildCommandRegistry() and the Python client's wire strings
• Live server run of load: POSTWORLD not performed — change is a standard Bukkit key and behaviorally the default; verified only that the plugin loads under MockBukkit

https://claude.ai/code/session_01AcK3SgXRTVzAKBdPZw72sr