docs(llms.txt): add GET /api/v1/stacks/:slug + canonical browser auth surface

[mastermanas805]

Summary

Sync agent-facing llms.txt with two surfaces that exist in api/internal/router/router.go but were missing here:

1. GET /api/v1/stacks/{slug} — already live (openapi.go L2268), missing from llms.txt. Agents had no way to inspect a stack they'd just created.
2. Browser auth surface (/auth/email/{start,callback}, /auth/github*, /auth/me, /auth/logout) — grouped bullet so agents don't try to POST non-existent /auth/login or /auth/refresh (a known CLAUDE.md drift settled in BIZ-FINDING-6 thread; CLAUDE.md fixed in same sprint).
3. Enriched POST /stacks/new response shape (was just 'requires JWT', now documents {ok, slug, stack_url, services: [...]} + anonymous-tier behaviour).

Source of truth

• api/internal/router/router.go (canonical route list)
• api/internal/handlers/auth_logout.go:18-25 (no /auth/refresh, explicit scope-out)
• CLAUDE.md 'Live API surface' (updated in same sprint to match)

Follow-up (NOT in this PR)

instanode-web/public/llms.txt is a stale copy of this file. Per CLAUDE.md 'Operator follow-ups' note (content repo has no auto-deploy), operator must manually re-sync after this merges. I have not opened the instanode-web companion PR — the operator should either:

• merge this, then cp the file across in instanode-web and open that follow-up PR; or
• pull the rsync into the content repo's CI (separate config change).

Closes

• BIZ-FINDING-5 (vector + stacks parity) — CLAUDE.md half closed earlier in sprint, this is the llms.txt half.
• BIZ-FINDING-6 / UI-FINDING-4 (auth surface drift) — CLAUDE.md half closed earlier, this is the llms.txt half.

🤖 Generated with Claude Code