v0.13.1

• Docs Added docs/auth-backend.{md,zh-CN.md} — end-to-end guide for wiring the new <Access> system to a real backend. Covers the UserInfo contract, three permission models (pure RBAC / pure ACL / hybrid) with SQL schemas, middleware examples in Node/Express, Spring Boot, Python/FastAPI, and Go, session vs JWT trade-offs with refresh-token rotation, data-level filtering (Postgres RLS), permission cache invalidation, best practices, and a migration checklist from existing auth backends.
• Docs Both READMEs now have a "Wiring a real backend" section linking to the new guide.