docs: README/QUICK_START coverage for S3 driver and Functions

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

QUICK_START.md

@@ -65,6 +65,9 @@ The important ones:
 | `SIGNUP_ENABLED` | Open public sign-up after bootstrap — default `false`; admins override in-app |
 | `PRIMORA_MANAGED` | Managed tier flag — enables OAuth providers when `true`; self-hosted is email/password only |
 | `USER_RATE_LIMIT_PER_MINUTE` / `API_KEY_RATE_LIMIT_PER_MINUTE` | Throttling defaults — overridable in-app |
+| `BACKEND_STORAGE_DRIVER` | `local` (default, `BACKEND_STORAGE_ROOT`) or `s3` — S3-compatible object storage |
+| `S3_ENDPOINT` / `S3_BUCKET` / `S3_ACCESS_KEY_ID` / `S3_SECRET_ACCESS_KEY` | S3 backend config (with `S3_REGION`, `S3_PREFIX`, `S3_PATH_STYLE`) |
+| `FUNCTIONS_RUNTIME` / `FUNCTIONS_TIMEOUT_SECONDS` | JS runtime for Functions — `auto` (default, resolves `bun`/`deno` from PATH) or a binary path; 30 s default timeout |
 | `VITE_DEMO_MODE` | Enable the client-side demo workspace |
 
 ### Instance administration

README.md

@@ -48,8 +48,12 @@ Supabase, with no hosted tier - your data stays on your hardware.
 
 - **Organizations & projects** - workspaces with scoped org and project roles.
 - **Auth** - email/password plus optional GitHub, Google, Discord, and Microsoft OAuth. JWTs verified by the API against JWKS.
-- **Storage** - S3-style buckets on your local filesystem, public or private.
-- **Collections** - schema-flexible JSON documents in Postgres JSONB.
+- **Storage** - S3-style buckets on local disk or any S3-compatible backend (AWS, MinIO, Garage, R2), public or private.
+- **Collections** - schema-flexible JSON documents in Postgres JSONB, with filter/order queries.
+- **Functions** - project-scoped JS/TS executed by bun/deno on the host, with per-run logs.
+- **Vault** - AES-256-GCM project secrets plus an Argon2id/XChaCha20 local vault in the CLI and desktop app.
+- **Automation** - scheduled jobs, inbound webhooks, telemetry alert rules, and `secret://` refs resolved at delivery.
+- **Realtime** - SSE event stream with a typed client SDK (`@primora/client`).
 - **API keys** - `prm_<prefix>_<secret>` credentials, shown once.
 - **Audit log** - every mutating request recorded, with CSV/JSON export.
 - **Demo mode** - fully client-side seeded workspace via `?demo=true`.