docs: add multi-tenant authorization cookbook

[benpsnyder]

Summary

• Adds a multi-tenant authorization cookbook for SpacetimeDB modules.
• Shows where to put JWT claims versus mutable authorization tables.
• Includes table model examples, reducer guard patterns, sender-filtered views, impersonation, API-key/robot grants, gateway considerations, and an authorization checklist.

Why

Issue #5004 includes a SaaS gateway/auth stack where app-owned auth identifies the caller, but SpacetimeDB still needs module-local authorization for tenant membership, roles, robot grants, impersonation, and audit. This cookbook connects the auth broker and gateway docs to concrete table, reducer, and view patterns.

Validation

• git diff --check
• pnpm --dir docs typecheck
• pnpm --dir docs build

The docs build still reports the existing docusaurus-plugin-llms-txt warning for /docs/ask-ai/ask-ai; the build completes successfully.