docs(README): clarify Quick Start project selection and env writing

[sunshinexcode]

Summary

Clarify the README Quick Start around interactive agora init project selection, --project / --new-project, .agora/project.json vs project use, and that App ID / App Certificate come from the CLI writing the template env file—not a Console env download. Also align the Python template InstallCommand / nextSteps with the upstream quickstart (bun run setup).

Type of change

• Bug fix (non-breaking)
• New feature (non-breaking, additive)
• Behavior change to an existing command (potentially user-visible)
• Breaking change (CLI flag, exit code, JSON shape, or error.code rename/removal)
• Documentation only
• CI / packaging / tooling
• Refactor (no behavior change)

Note: internal/cli/quickstart.go only changes the Python template InstallCommand string used in nextSteps output (bun install → bun run setup) so it matches agent-quickstart-python. No JSON envelope, exit code, or flag change.

Public-contract impact

• No public-contract impact.
• Adds or changes a JSON envelope shape — described below.
• Adds a new error.code — added to docs/error-codes.md.
• Renames or removes an error.code — flagged as breaking, included in CHANGELOG.
• Changes an exit code for an existing command — flagged as breaking.
• Adds or changes a CLI flag — documented in help text and (if user-facing) docs/automation.md.

Test plan

• go test ./... passes locally.
• make lint passes locally (gofmt, golangci-lint, error-code coverage audit).
• New behavior is covered by a JSON-mode integration test in internal/cli/integration_test.go.
• Edge cases are covered by unit tests in internal/cli/app_test.go (where applicable).

Manual check:

• Diff-review README Quick Start / Env Files / troubleshooting copy for accuracy.
• Confirm Python nextSteps after agora init --template python shows bun run setup then bun run dev.

Documentation

• CHANGELOG.md updated under ## Unreleased (Added / Changed / Deprecated / Removed / Fixed / Security).
• docs/automation.md updated for any user-facing JSON shape, env var, or flag change.
• docs/error-codes.md updated for any new error.code (or N/A).
• README.md updated if the command tree, install path, or quickstart changed.
• AGENTS.md updated if engineering or release process changed.

Security checklist

• No credentials, App Certificates, tokens, or PII added to fixtures, logs, or test output.
• No new outbound network call without timeout / context cancellation.
• No new file written under user $HOME without 0o600 perms when it can contain credentials (e.g. session, config).
• No new unsafe import.

Additional notes

Compare: https://github.com/AgoraIO/cli/compare/docs/readme-quickstart?expand=1