Split mTLS into its own page
Authentication: document mTLS client certificate auth
Add Authentication page documenting client token sources Covers --auth-token-path (file with periodic re-read) and --auth-token-script (command that emits {token, expires_at} JSON). Linked from Home and Setup-Guide. Adds GHA OIDC and vault examples.