docs: add machine actor auth guide

[benpsnyder]

Summary

• Adds a standalone authentication guide for machine actors, API keys, scheduled jobs, webhooks, MCP servers, AI agents, and customer-built integrations.
• Documents the app-backend broker pattern: validate long-lived credentials outside SpacetimeDB, mint short-lived OIDC-compatible SpacetimeDB JWTs, and re-check module-local grants in reducers.
• Includes Better Auth API Key plugin framing, robot/delegated actor claim shapes, private module table suggestions, reducer authorization checks, gateway topology tradeoffs, and CLI/CI smoke-test guidance.

Why

Issue #5004 calls out machine actors, API keys, and integrations as a distinct SaaS auth surface. Human web sessions, enterprise SSO, and framework gateway examples are now covered in adjacent draft PRs; this fills the non-human actor story without requiring Better Auth or any one provider as the canonical source of truth.

Validation

• git diff --check
• pnpm --dir docs typecheck
• pnpm --dir docs build

The docs build still reports the existing docusaurus-plugin-llms-txt warning for /docs/ask-ai/ask-ai; the build completes successfully.