docs: create AUTHENTICATION.md
Full auth contract: Telegram/QR session login (live), Ed25519
challenge/response admin auth (wired client-side, dormant -
authInterceptor not registered, ed25519AuthGuard unused by any route),
JWT structure, refresh, expiration, rotation, logout, session
invalidation, role hierarchy, tenant isolation, permission model.
4 Mermaid sequence diagrams.
Flags 9 Requires-backend-decision items and the pre-existing
duplicate AdminRole definition (core/auth vs admin/users models).
53343fa711