docs(airplay): clear the stale "untested against hardware" caveats

[nikhilshastry2003]

Follows up on the write-up in #27: transient pair-setup completed against a Mac running AirTunes/950.7.1 on 2026-08-26 (after #41/#42/#43), and that comment listed the caveats that should now read "pairing confirmed against hardware; mirroring unconfirmed". This does that, and the same for the other places that said the same thing.

Docs only — no behaviour change. The one .rs touched is the //! module comment in hap_pairing.rs.

What changes

• Status lines — README.md (status paragraph + protocol table), docs/protocols.md table, docs/crypto.md summary table, crates/openplay-airplay/README.md: pairing confirmed, mirroring not.
• docs/crypto.md — the "Caveat: still unconfirmed against hardware" section becomes "Confirmed against hardware" and records what the run established: the 384-byte B corroborating the group from the far side, the two bugs it took to reach M4 (X-Apple-HKP, minimal-encoding g), that transient pairing ends at M4 with no pair-verify, the control channel, the 0x03 back-off trap, and why mirroring is still open. The 403 attempt stays, as "What the first attempt produced". Summary table gains a control-channel row; the pair-verify row now says it has no callers rather than "unreachable until pairing is confirmed".
• docs/protocols.md — the AirPlay flow said "transient pair-setup followed by pair-verify, then POST /stream on the verified connection". session.rs does not do that: no pair-verify, POST /stream goes through control_channel.rs, and the path stops with an explicit error because MirrorStream cannot yet frame video for the encrypted connection. Now described as such. Pairing-modes list says which flow reaches M5/M6 and that pair_verify has no callers.
• docs/troubleshooting.md — adds the two failures that are not what they look like (0x03 back-off; connection closed right after a successful M4) and the "mirror stream cannot yet send video" stop.
• docs/contributing.md — the "Not useful" paragraph sat in the middle of the bullet list, orphaning the two bullets after it. Moved below the list. "Confirm pairing" item becomes "confirm mirroring".
• control_channel.rs and the control_probe example were not mentioned anywhere in docs/; added to crypto.md, the architecture crate table and the crate README.

Deliberately untouched

CLAUDE.md, and every sentence about the model-string / FairPlay refusal — #44 rewrites those, and touching them here would only conflict. Same for the "501 or 403" retry list in protocols.md, which #44 widens. Once #44 lands, its CLAUDE.md status bullet still says "unconfirmed against hardware (issue #27)"; that one line is the only follow-up.

Verified

• cargo fmt --all -- --check clean
• cargo clippy -p openplay-airplay --all-targets --all-features -- -D warnings clean
• cargo test -p openplay-airplay — 42 + 27 passed
• Every relative link and anchor under README.md and docs/ resolves (the new crypto.md#confirmed-against-hardware anchor included)

Not run: the full cargo test --all — this machine has no GStreamer, so -pipeline/-sender/-receiver do not build here. Nothing in the change can affect them.