docs: add app-owned auth broker guide

[benpsnyder]

Refs #5004

Summary

• Adds an App-Owned Auth Broker guide for translating an application session, API key, or service credential into a short-lived SpacetimeDB JWT.
• Documents a recommended claim contract, OIDC discovery/JWKS setup, token lifetime guidance, and module-side issuer/audience/token-type checks.
• Covers identity mapping implications when iss or sub changes, plus browser-direct versus server-gateway token usage.
• Links the guide from the Authentication overview and fixes a nearby typo.

Validation

• git diff --check
• pnpm --dir docs typecheck
• pnpm --dir docs build

Note: Docusaurus build completes successfully but still emits the existing llms-txt warning for /docs/ask-ai/ask-ai.

[cloutiertyler]

Hi @benpsnyder, thanks for your contribution to the docs. We don't accept draft PRs in our repo to keep our PRs relatively neat and manageable, so I'm going to close this for now, at least until you have a complete PR for us to review.