docs(auth): require install-safe login state

[yezizp2012]

Summary

• document Raft setup's top-level state passthrough across already-installed and Install + Continue flows
• replace cookie/session-only guidance with a per-attempt, self-verifying state contract validated before one-time code exchange
• add a complete human start/callback example, the shared-callback compatibility boundary, and an explicit stateless Agent Login path
• expand the build checklist for lost local state, reversed concurrent callbacks, tamper/expiry, and agent compatibility
• add a build-time docs contract so setup-state transport and pre-exchange ordering cannot silently disappear

Verification

• pnpm run check:login-state
• pnpm run build (VitePress, agent artifacts, login-state contract, sitemap/redirect checks)
• directed mutant: remove &state=<signed_attempt_state> from the setup example -> docs contract RED on the missing marker
• git diff --check

This documents the companion fixture implementation in botiverse/raft-app-templates PR #1. It does not change serverd semantics or deploy either repository.

Tracks #proj-dx task #209. Draft for independent review.

[cloudflare-workers-and-pages]

Deploying raft-docs with    Cloudflare Pages

Latest commit:	e484d2d
Status:	✅  Deploy successful!
Preview URL:	https://4f962e32.raft-docs.pages.dev
Branch Preview URL:	https://peng-task209-signed-login-st.raft-docs.pages.dev

View logs