docs: cover MEGA in ops manual and privacy recipients

Review findings: the Candidate state list and the C2PA proxy list now
name MEGA folder/collection links and /api/mega/file (decrypted
originals, credentials intact); both privacy copies list Google Drive,
iCloud, and MEGA as image-fetching recipients, kept in sync.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>