docs: pre-release documentation and metadata sweep

[Bccorb]

Summary

A repo-wide documentation sweep against current main (827b4ed) ahead of the release. An audit cross-checked every doc surface (both READMEs, root README, AGENTS/SECURITY/CONTRIBUTING, all JSDoc, pending changesets, and package.json metadata) against the actual code. The good news: the recent breaking changes (DELETE-only logout, POST OTP-generate, POST /magic-link, removal of user.sub and the issuer option, the named createSeamlessAuthServer export, the (req, opts) getSeamlessUser signature, and cookie security driven by options not NODE_ENV) are all already reflected correctly in the primary README. This PR fixes the exceptions.

Fixes

Release-notes contradiction (the reason this matters most). .changeset/adapter-usage-docs.md still claimed the Quick Start "passes every required option (cookieSecret, serviceSecret, issuer, audience)." issuer was removed in a parallel PR whose changeset ships in the same release. Compiled notes would have told adopters to add issuer (this changeset) and delete it (the removal changeset) at once. Corrected to authServerUrl, cookieSecret, serviceSecret, audience.

requireRole JSDoc would not compile. packages/express/src/middleware/requireRole.ts had @example code calling requireAuth() with no arguments, which is a TS error and throws at construction (via assertSecretStrength). This is the example surfaced on hover/IntelliSense. It also had a stray * and an unclosed ```ts fence that bled the example into the @param docs. Fixed to construct a guard and closed the fence.

README corrections.

• Quick Start logged http://localhost:3000 while calling app.listen(5000, ...). Now both say 5000.
• The createSeamlessAuthServer options block omitted resolveClientIp, a real supported option (documented in prose but missing from the canonical type listing). Added.
• The end-to-end flow referenced /auth/webAuthn/finish, which is not a route. Corrected to /auth/webAuthn/login/finish.

Metadata. Neither published package declared keywords. Added to both for npm discoverability.

Not changed (deliberately)

• SeamlessAuthUser.phone is typed string while the upstream /me shape and SeamlessUser use string | null. The docs correctly mirror the code, so this is a code inconsistency, not a doc one. It is already tracked in chore: post-release follow-ups from the pre-release audit #101.
• The narrative requireAuth() references in the architecture diagram and flow prose name the function rather than demonstrate a call, so they are left as-is.

Checks

core:    18 suites, 83 tests passed
express: 23 suites, 115 tests passed
build:   both packages Done

No em dashes. Changeset included (patch, both packages).