docs: expose privacy policy for Claude plugin review

[kev1n]

Contract

Prepare the existing AnyAPI plugin for Claude marketplace review: expose the existing privacy policy, keep maintainer-only instructions in a supported project-memory location, and explain legitimate own-service authentication without breaking supported clients. The marketplace Submit action remains outside this PR.

Change

• Add [Privacy](https://getanyapi.com/privacy) to the README Docs section.
• Move the existing maintainer-only shim from root CLAUDE.md to .claude/CLAUDE.md, correcting its relative link to ../AGENTS.md. Official Claude project-memory documentation supports both locations: https://code.claude.com/docs/en/memory (verified live by the parent agent through Aside).
• Add a factual README Authentication section: ANYAPI_API_KEY is issued by AnyAPI and sent only to api.getanyapi.com by the MCP configurations and REST/SDK examples, not credentials for unrelated services.
• Sync the skill's opening catalog count from 402 to 411, matching the existing live canonical skill.
• Leave the plugin manifests, credential configurations, SDK reference, CLI requirements, logos, and runtime behavior unchanged.

Proof

• git diff --check: passed.
• bash scripts/check.sh: passed after the final changes (skills checks passed (1 manifest-listed skill)). The unmodified gate fetched the live canonical skill and SDK reference, confirmed exact skill-body equality, matching trigger frontmatter, manifest/version consistency, and exact SDK-reference equality.
• Official installed claude plugin validate --json passed for both .claude-plugin/marketplace.json and .claude-plugin/plugin.json, with no manifest errors or warnings.
• Main-repository architecture counter passed for every changed document: README 51 code lines, relocated maintainer shim 3, canonical skill 146; each below the existing 300-line policy.
• Diff against origin/main confirms .mcp.json, gemini-extension.json, .cursor-plugin/plugin.json, assets/logo.png, and skills/anyapi/references/sdks.md are unchanged.
• Before the count sync, the same unmodified gate failed identically on this branch and an isolated clean checkout of origin/main at f5e01ff056852c5a97c378b7add85b799fe11c1c.
• Diagnostic comparison using the gate's own canonical loader and frontmatter splitter found exactly one body difference: You reach 402 APIs in main versus You reach 411 APIs in the live canonical skill. The gate compares bodies byte-for-byte and does not read README.md. This PR restores that authoritative sync without changing or bypassing the check.
• Fetched and compared the latest origin/main before the final changes; it remains f5e01ff056852c5a97c378b7add85b799fe11c1c.
• Parent agent owns live portal revalidation after merge; this PR is not merged.

Ecosystem impact

Documentation-only privacy/authentication information, supported maintainer-instruction relocation, and canonical count sync in the published skill. Catalog, discovery, MCP, OpenAPI/payment, CLI, SDKs, n8n, and hosted docs remain unaffected: no runtime contract or authored behavior changes. Claude project maintainer instructions retain the same AGENTS.md owner. Cursor and Gemini retain their working own-key authentication and Cursor retains its logo. The skill body now matches the already-live canonical source; no upstream source change or deployment is needed.

Portal holds

Legitimate credential-environment holds and the unread raster-logo reference still need human review. No credential behavior or inert logo was removed, obfuscated, or changed merely to suppress detection, and this PR does not guarantee that the portal automatically clears those holds. The preserved logo is a 512x512 RGBA PNG containing only IHDR, IDAT, and IEND chunks with no trailing bytes.

Deviations

The initially README-only privacy-link scope expanded to the exact measured canonical catalog-count sync required to restore the repository gate, then to the user-authorized maintainer-instruction relocation and factual authentication explanation. No other remediation is included.