Improve CloudFormation documentation:

- Overview — architecture diagram + what the stack creates, at-a-glance prerequisites table
- Prerequisites (4 numbered, each independently completable) — account/region, VPC/subnets, TLS cert (with warnings about FQDN and empty ARN), key pair
- Step 1: Subscribe — marketplace flow, noted as one-time-only
- Step 2: Launch — parameters in 4 groups matching the template UI, with "what to enter" guidance not just a flat list
- Step 3: Verify — fixed the wrong port (was :9090, now just /users/sign_in)
- Step 4: DNS (optional) — clarified the difference between ACM validation CNAME and routing CNAME
- Troubleshooting — four documented error scenarios including the two you hit yourself and the login-via-LB issue

Author: sbrossie