docs/modes.md: where a file's bytes live, and what deleting one promises #1748

Problem

docs/modes.md explains what each runtime mode means for an operator. #1606 changes that for files, and an operator who reads the page today learns none of it.

Two things are new. Where a file's bytes live on a hybrid deployment, and what "deleted" promises.

Proposal

Say where the bytes live. On a hybrid deployment the platform supplies the storage and the data plane writes through a short lived grant, so an operator runs no new service and configures no bucket. On a standalone deployment the operator's own files_backend holds them, as it does today.

Say what deletion promises, and say it separately from what revocation promises. Revoking access is immediate and local. Physically removing bytes depends on who owns the store, and where an operator owns it they can retain copies outside Otari that no guarantee here reaches.

Say that local is a directory on one machine. It is correct for a single node and for development, and it silently serves a subset of requests behind more than one replica. #1607 tracks the code side of that; this is the operator-facing half.

Name the retention a hybrid deployment gets and where the number comes from, once #1731 settles it.

Done when

• An operator can tell from the page whether they need storage of their own.
• The deletion promise is stated per bucket owner, not once.
• Nothing on the page describes how the gateway implements any of it.