Expand auth docs and add change requests page

[atc964]

Summary

• Authentication (buyer-2m7): Expanded from a half-page inbound-only doc to full coverage of both inbound and outbound auth. Now documents ApiKeyStore (add/get/remove/rotate/list), AuthMiddleware (request decoration, 401 handling), multi-seller credential management, key acquisition workflow with sequence diagram, key rotation, and DealsClient auth patterns.
• Change Requests (buyer-n4e): New page documenting how the buyer submits post-deal modifications to seller orders. Covers severity levels (minor/material/critical), auto-classification rules, the 7-state lifecycle, validation constraints, and three buyer workflow patterns (simple, poll, batch). Notes that a typed client is planned but not yet implemented.
• Updated mkdocs.yml nav to include the new Change Requests page under API Reference.

Test plan

• Run mkdocs serve locally and verify both pages render correctly
• Verify all internal links resolve (deals, bookings, authentication cross-refs)
• Verify external links to seller docs load correctly
• Confirm mermaid diagrams render in both pages

🤖 Generated with Claude Code