Rewrite the docs and README, with an API reference and tested examples

[bensynapse]

This is the docs half of the 2026-10-06 docs review. The code half, the
docstrings and two clearer messages, was #305.

What changes

Truthful about 5.0.9. Every page has a banner: the docs describe 5.0.10,
and PyPI has 5.0.9. Security opens with "If you are on 5.0.9" and a wrapper
that stops 5.0.9 from sending exception messages to clients. It's tested on
5.0.9 and on main, and it keeps the params check working. The 5.0.10 features
have "New in" or "Changed in" notes. Those cover debug, max_batch_size,
per-request validation, NaN, serializer failures, plain methods under
async_dispatch, serve() returning 204, the warnings and the typing changes.

Examples that follow Security. Every example passes max_batch_size=100
and limits the body to 1,000,000 bytes, using each framework's own setting
where it has one. They listen on localhost:8000, which is where the
jsonrpcclient examples connect. The ZeroMQ ones bind 127.0.0.1, not *.
The http.server example answers a missing Content-Length with 411, an
oversized body with 413, and bytes that aren't UTF-8 with a Parse error.
check_examples.py now sends each server an oversized batch and an oversized
body too.

A quickstart you can run. Start serve("localhost", 8000), then call it
with curl and with jsonrpcclient. CI runs the exact curl line from the docs,
and the jsonrpcclient snippet against the real quickstart server.

New pages. The site has an API reference (mkdocstrings) and a migration
guide, from 4.x and from 5.0.9. Errors and logging lists every logger. There are also pages on notifications and batches, context, validation,
typing, testing and threads, and one page per framework. The FAQ and roadmap
were rewritten. The roadmap no longer links the old 6.0 draft pull request.
The changelog, contributing guide, security policy and license are on the
site.

Site. It has the client's overrides, extra.css, copy button fix and
accessibility script. The pink is darkened to #c2185b (5.9:1 on white) and
#f48fb1 for dark-mode links. Pages get their own descriptions and
Open Graph tags, and a visible h1. The site has a social card, a neutral {}
favicon, a 404 page, and a redirect from http to https.

CI. A new site job builds the docs and opens every page in Chromium,
light and dark, at 1280 and 375 pixels. It fails on any serious or critical
axe-core finding, a JavaScript error, a broken internal link or anchor, or a
page that scrolls sideways. axe-core is downloaded by version and checked
against its published hash. tests/test_threading.py calls dispatch from 8
threads at once, and CI runs it on 3.14t too.

README and repo. The README uses the agreed layout and renders on PyPI
without a bare URL. The tagline says "JSON-RPC 2.0" everywhere. The issue
forms send questions to Discussions and say how to find the version. The
release workflow refuses to publish while mkdocs.yml or the README still call
the version unreleased. RELEASING.md lists those steps and the advisory step
for a security release. The changelog heading is now "5.0.10 (not released
yet)". The missing 5.0.1 entry, missing dates and a duplicate 3.4.3 are fixed.

Checked locally

• pytest with 100% coverage on 3.8, 3.13 and 3.14t (344 tests)
• ruff check, ruff format, mypy and pyright
• all 85 runnable doc blocks, with every framework installed
• all 13 example servers through check_examples.py
• mkdocs build --strict
• check_site.py: 33 pages, 4 views each, no problems. On the old site it
  reports 92, so it does catch them.
• python -m build, twine check, check-wheel-contents and check_metadata