docs: kubernetes hot-reload guidance

README Kubernetes section: what a Middleware CR edit actually does
(Traefik builds a new instance, warm-fills discovery, swaps it in; requests
in flight finish on the old one), what survives a rebuild (Redis-backed
counters and cache — windowKey's key never carries instance identity) vs
what resets (in-memory fallback counters, down-latches, the discovery
cache), why new models via discovery need no config edit, why the users
Secret must be a whole-volume mount (subPath never receives a kubelet
update) and how the plugin's own 5s mtime poll picks up the resulting
symlink swap, and why a file-provider dynamic config needs directory:
rather than filename: in Kubernetes (ConfigMap symlink swap) and under
Docker Desktop (VirtioFS fsnotify) alike.

examples/kubernetes.yaml: annotated the existing (already-correct,
no-subPath) users Secret volume mount explaining why subPath would
silently break Secret updates, so a future edit doesn't 'simplify' it
into one.

examples/kubernetes.yaml

@@ -234,6 +234,14 @@ spec:
 #          secret: {secretName: llmgw-users}
 #      deployment:
 #        additionalVolumeMounts:
+#          # Whole-volume mount — no subPath — is required, not a style
+#          # choice: a subPath mount binds once at pod start and the
+#          # kubelet never updates it again, so editing the llmgw-users
+#          # Secret above would never reach this pod. A whole-volume mount
+#          # updates via the kubelet swapping a symlink for the whole
+#          # directory, which users.file's own 5-second mtime poll
+#          # (reloadEvery, users_file.go) picks up with no pod restart —
+#          # see ../README.md#config-hot-reload.
 #          - name: llmgw-users
 #            mountPath: /secrets/llmgw-users
 #            readOnly: true