feat: reorganise bash scripts and add comprehensive documentation (#6)

## Summary

This PR completes the bash script restructuring and adds comprehensive documentation across all script categories.

### Bash Restructuring

- Moved cohort shell scripts (`remove_github_members.sh`, `update_github_teams.sh`) from `python/cohort/` into a new `bash/cohort/` directory
- Moved existing bash utilities (`add-keys-to-git.sh`, `fix-yubikey-perms.sh`, `list-yubikey-ssh-keys.sh`) into a new `bash/yubikey/` subdirectory
- Updated `run.sh` to support **Bash** as a third language option alongside TypeScript and Python
  - Bash scripts are run directly (no 1Password secret injection needed)
  - Category discovery and script listing works the same as for TS/Python
  - Removed dead "Root Scripts" logic that was no longer needed

### Documentation

Added `README.md` files for all script categories that were missing them:

- `bash/cohort/README.md` — cohort GitHub team management scripts
- `bash/yubikey/README.md` — YubiKey SSH key and permission utilities
- `typescript/src/crowdin/README.md` — Crowdin translation management scripts
- `typescript/src/discord/README.md` — Discord bot utility scripts
- `typescript/src/discourse/README.md` — Discourse forum management scripts
- `typescript/src/gitea/README.md` — Gitea bulk repository operation scripts
- `typescript/src/github/README.md` — GitHub API interaction scripts
- `typescript/src/music/README.md` — Music file metadata tools
- `typescript/src/s3/README.md` — S3-compatible object storage scripts
- `typescript/src/security/README.md` — Security analysis and reporting scripts
- `python/cohort/README.md` — Updated to remove moved shell scripts, fix usage commands

Also updated project-level docs:

- **`README.md`** — Corrected project structure, fixed running instructions (removed references to non-existent `make run-ts`/`make run-py` targets), added Bash prerequisites
- **`CLAUDE.md`** — Updated project overview, structure, development standards, and script-adding guides to reflect the current state of the project

✨ This PR was created with help from Hikari~ 🌸

Co-authored-by: Naomi Carrigan <commits@nhcarrigan.com>
Reviewed-on: #6
Co-authored-by: Hikari <hikari@nhcarrigan.com>
Co-committed-by: Hikari <hikari@nhcarrigan.com>

bash/cohort/README.md

@@ -0,0 +1,75 @@
+# Cohort Bash Scripts
+
+Shell scripts for managing GitHub team membership during the NHCarrigan spring cohort programme. These scripts handle one-off team changes that are too complex or bulk-oriented to do manually through the GitHub web interface.
+
+All scripts use the `gh` CLI for GitHub API calls. Run `gh auth login` before using them.
+
+## Getting Started
+
+Run scripts via the interactive runner from the project root:
+
+```bash
+make run
+# Select: Bash → cohort → <script>
+```
+
+Or run directly:
+
+```bash
+bash bash/cohort/<script-name>.sh
+```
+
+## Table of Contents
+
+- [remove\_github\_members.sh](#remove_github_memberssh)
+- [update\_github\_teams.sh](#update_github_teamssh)
+
+---
+
+## remove_github_members.sh
+
+Removes a hardcoded list of inactive members from their GitHub organisation teams in the `nhcarrigan-spring-2026-cohort` organisation. Covers both standard team membership and `-leaders` sub-team membership where applicable.
+
+### Usage
+
+```bash
+bash bash/cohort/remove_github_members.sh
+```
+
+### Environment Variables
+
+None. Uses `gh` CLI authentication — run `gh auth login` first.
+
+### Data Files
+
+None. Member usernames and team slugs are hardcoded in the script.
+
+### Notes
+
+- The member list and team assignments are specific to a point-in-time removal event. Update the script with the correct usernames before each use.
+- Each removal command uses `|| true` so a single failure (e.g. member already removed) does not abort the entire script.
+
+---
+
+## update_github_teams.sh
+
+Orchestrates a multi-step GitHub team restructure: removes all members from a dissolved team, clears its leaders sub-team, then adds each member to their new team. Also promotes a member to leader in their new team.
+
+### Usage
+
+```bash
+bash bash/cohort/update_github_teams.sh
+```
+
+### Environment Variables
+
+None. Uses `gh` CLI authentication — run `gh auth login` first.
+
+### Data Files
+
+None. All member usernames, team slugs, and role assignments are hardcoded in the script.
+
+### Notes
+
+- This script is specific to a one-off team restructure (Jade Jasmine dissolution). Update the member list and team assignments before each use.
+- The script exits immediately on any error (`set -e`). If a step fails, check whether the member or team already exists in the target state.