docs: slice binding example (#170) + JWT timing-attack caveat (#100)

[vishr]

Two small docs content fixes.

#170 — Document binding repeated query params to a slice

Struct-tag binding to a slice field wasn't documented (only the fluent binder showed it). Adds a Slices subsection to the binding guide:

// GET /search?tag=go&tag=web&tag=api
type Filter struct {
	Tags []string `query:"tag"`
}
// f.Tags == []string{"go", "web", "api"}

Across all 5 locales (heading + lead-in translated; code block identical).

#100 — JWT example timing attack

The cookbook login handler compared hard-coded credentials with a plain !=. Replaced the bare // Throws unauthorized error comment with a caveat that it's demo-only and that production code should verify a hashed password with a constant-time compare (e.g. bcrypt.CompareHashAndPassword) to avoid timing attacks. Comment is identical across all 5 locales (matching the docs' code-comment convention).

Verification

• Build passes (301 pages).

Closes #170
Closes #100

🤖 Generated with Claude Code