Document required access per integration and DNS provider

Each adapter performs write actions, not just reads (start/stop a
guest, edit a DNS record, rerun a CI job, etc.), so a read-only
credential silently works for the dashboard views but fails the
moment you use an action. Lists the exact endpoints/permissions
needed per target system, drawn from each adapter's own auth code and
header comments (e.g. Proxmox's Sys.Audit/Datastore.Audit split,
Azure's DNS Zone Contributor role, Loopia/Pi-hole/cPanel having no
scoped-credential option at all).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

README.md

@@ -115,7 +115,9 @@ All modules from the original plan are built:
 All six integrations follow the same config-in-UI + encrypted-credentials
 pattern, added (and edited — e.g. to rotate an expired API token without
 recreating the whole integration) through **Integrations → Manage
-integrations**.
+integrations**. See [INTEGRATIONS.md](INTEGRATIONS.md) for exactly what
+credential to create and what access it needs in each target system,
+for every integration and DNS provider.
 
 **Verified for real, end to end**: every module above — including all six
 integrations, both their read-only views and their write actions