docs(sdk-spec): document optional appToken for Cloud install scoping

[onamfc]

Companion to #24 (1.15.0 release) and the four SDK PRs.

`SDK_SPEC.md` is the canonical contract that contributors building new LinkForty SDKs read first. Today it doesn't mention `appToken` — so any new SDK (community or otherwise) would skip it and customers using that SDK with Cloud would silently lose organic-install attribution.

What changed

• Section 2 (Deferred Deep Linking) — new "App token (Cloud only)" sub-section explaining:
  • Where to find the token (Cloud Dashboard → Workspace Settings)
  • Format (`at_<32 hex>`) and the public-token safety model
  • Self-hosted Core ignores the field
  • Attribution behavior with vs. without a token
  • Example install request body
• Section 11 (Configuration) — adds `App token` row to the Optional config table.
• API Endpoints Reference — notes `POST /api/sdk/v1/install` body accepts optional `appToken`.

The four official SDKs (RN, Expo, iOS, Android) already implement this in their open PRs.

Out of scope

• Backend implementation — already shipped in feat(sdk): accept optional appToken on /api/sdk/v1/install #24 (v1.15.0). The `appToken` field is accepted and ignored by Core; Cloud uses it for org scoping.
• Endpoint behavior changes — none. This is doc-only.

Test plan

• Read Section 2 → "App token (Cloud only)" — checks the spec is internally consistent
• Verify Optional configuration table renders and the in-page link to `#app-token-cloud-only` resolves
• Confirm API Endpoints Reference table reads cleanly

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!