docs: require HETZNER_CA_KEY for hetzner setups
Update docs for Hetzner usage and OIDC-first AWS setup
Created FAQ (markdown)