feat(door): flexible transport + clearer controller/generic API docs

The app is cloud-hosted, so a connection's target is not assumed to be
LAN-only: any pinned host (public controller/proxy or VPN-reachable LAN
device) is allowed except cloud-metadata/link-local. KNOWN_DOOR_
CONTROLLERS surfaces the controller type with source links (HeatSync/23b
native -> the heatsynclabs + zyphlar repos; otherwise generic HTTP).
The generic adapter form now explains the request model and every
{slot}/{tag}/{perm}/{door}/{pw} placeholder. Copy and the migration
comment corrected away from "LAN-only".

scripts/035_door_connections.sql

@@ -8,8 +8,10 @@
 --     row in the existing AES-256-GCM `secrets` vault; the executor loads and
 --     decrypts it server-side only and never returns/logs it.
 --   * pinned_host is the SSRF pin: the executor will only ever call that exact
---     host (no redirects, size/time caps). A door is LAN-only, so private
---     ranges are allowed -- but only the pinned host, never metadata.
+--     host (no redirects, size/time caps). The app is cloud-hosted, so the
+--     target may be a public controller/proxy OR a VPN-reachable LAN device;
+--     any pinned host is allowed (public or private) EXCEPT cloud-metadata /
+--     link-local, which are always blocked.
 --   * adapter is 'native_heatsync' (verified query-string firmware) or
 --     'generic_http' (admin-supplied per-verb templates).
 --   * allow_member_self_entry opts a connection into the member "buzz me in"