[rennf93]

Closes #14

Adds a "Route policies" page (docs/routes.md) and links it from the nav, the docs home and the usage page.

What the page covers

• How a request finds its route: optional method plus path, exact or prefix match, longest path wins, one route per request (a specific route replaces a prefix route's options).
• The default routes, and what replacing one or setting it to null does.
• Behavior rules: rule_type, threshold, window, pattern, action, ban_duration, with units and defaults; the status:, json:, regex: and plain-text patterns; what ban, log, alert and throttle do (in guard-core-php 4.4.0 throttle only logs); counting per IP and per method plus exact path; passive mode and Redis.
• Every route option, grouped, with an example, unit, the status code it returns and its traps (options that need ipinfo or Redis, lowercase exclusion entries, authRequired/apiKeyRequired failing without a verifier).

Also fixes the README and usage wording: the default 401 ban rule counts per path, not across the /api/v1/ prefix.

Verification

• Every claim read at guard-core-php v4.4.0 and psr15-guard v1.6.1 (the versions in the module composer.lock). The json: array pattern and the route rule with a body pattern while behaviorScanResponseBody is off were also run against a composer install of guard-core-php 4.4.0: json:tags[]==admin matches, json:items[].status==error does not, and the route rule is accepted but never evaluated ([false,false]).
• mkdocs build --strict: exit 0, anchors configuration.md#redis and #trusted-proxies-and-ipaddressserverparam present.
• pre-commit run on the changed files: all hooks pass (markdownlint included).

Docs only, no code or config change.