docs(federation): operator setup + migration guides for federated tier (FED-M1-11)

- docs/federation/SETUP.md (NEW, 119 lines): what federated is,
  prerequisites, docker compose start, config snippet, mosaic gateway
  doctor health check, troubleshooting (port conflicts, pgvector errors,
  Valkey connection)
- docs/guides/migrate-tier.md (NEW, 147 lines): when to migrate, dry-run
  first, what gets migrated/skipped (with rationale for accounts +
  provider_credentials), idempotency + advisory-lock semantics, manual
  verification queries, no in-place rollback
- README.md: 1-line blurb in Configuration section linking to both

All commands verified against actual CLI surface in
packages/storage/src/cli.ts and packages/mosaic/src/commands/gateway-doctor.ts.

Refs #460

README.md

@@ -80,6 +80,8 @@ If you already have a gateway account but no token, use `mosaic gateway config r
 
 ### Configuration
 
+Mosaic supports three storage tiers: `local` (PGlite, single-host), `standalone` (PostgreSQL, single-host), and `federated` (PostgreSQL + pgvector + Valkey, multi-host). See [Federated Tier Setup](docs/federation/SETUP.md) for multi-user and production deployments, or [Migrating to Federated](docs/guides/migrate-tier.md) to upgrade from existing tiers.
+
 ```bash
 mosaic config show           # Print full config as JSON
 mosaic config get <key>      # Read a specific key