Remove unregistered templates and the unused throttle service, fix stale docblocks and README claims, and document e-mail based linking and the connector's webhook duties

Problem/Motivation

Dead code and stale documentation:

• hook_theme registers only the chooser and the portal. templates/subscription_entity.html.twig, templates/subscription_plan.html.twig, subscription_entity.page.inc and subscription_plan.page.inc are never used; the entity view builder's #theme is unregistered, so canonical entity pages render bare children. The README says "the two entity templates" can be overridden.
• subscription_manager.refresh_throttle is declared in the services file and referenced nowhere in src/; its docblock describes a /user/{uid}/membership route that does not exist. #3629972: Dedupe and rate-limit the remote calls made on registration, login and the subscribe and portal routes decides whether a throttle is wanted; this issue removes the dead declaration if that issue does not adopt it.
• The README says Administer Subscription plans grants access to any user's management page; manageSubscriptionAccess() checks administer subscriptions only.
• Stale procedural names in docblocks in SubscriptionManagerService and SubscriptionEntity; the controller's class doc still says "UserSubscriptionsController".
• phpstan-baseline.neon ignores two \Drupal calls in SubscribeMenuLink that no longer exist.

Security notes the README does not make:

• The user-insert and login hooks link remote subscriptions to accounts by e-mail address and grant the plan's roles on the spot. On a site with "require e-mail verification" off, anyone registering with a paying customer's address receives that customer's roles, and the single-active invariant attaches the contract to that account. The module relies on the site verifying e-mail ownership and should say so under Configuration.
• The module exposes no unauthenticated routes, so webhook signature verification and replay protection are entirely the connector's responsibility; "For connector maintainers" never says this.
• The engine sends resubmission, proration and rebill_of context keys to charge() that ChargeBasedConnectorInterface does not list.

Proposed resolution

• Either register the entity templates properly (and test that an entity canonical page renders through them) or delete the four files and fix the README; recommended: register them, since the fallback pages exist for sites without Views.
• Remove the throttle service declaration in coordination with #3629972: Dedupe and rate-limit the remote calls made on registration, login and the subscribe and portal routes (comment below), fix the permission sentence, the docblocks and the baseline.
• README: the e-mail verification dependency under Configuration; webhook authentication and replay under "For connector maintainers"; the three context keys in the interface docblock.

Remaining tasks

• Decision on templates, implementation, a Kernel render test; a short change record if the service is removed.

User interface changes

Entity canonical pages render through their templates.

API changes

Possible removal of an unused service.

Data model changes

None.