docs: bring the README and guides up to date with v1.26 and Socrate v1.14

[ovander]

What and why

The docs had fallen behind the code and Socrate's token contract. Every statement below was checked against go doc, the conformance fixtures and go-oauth2's CHANGELOG.

• README.md:
  • Package table: apierror problem details, ctxutil scopes and audiences, httpware.RequireTenantWith, jwtauth opt-in checks.
  • "Which package" table: adds KeyedRateLimiter and RequireScopes.
  • jwtauth section: application scopes need Socrate v1.14.0 or later, and it describes what a service-account token carries.
  • Troubleshooting: a new row for 403 insufficient_scope.
  • Minor: the buildinfo example shows go1.27.2; a missing separator and a gofmt misalignment are fixed.
• docs/CLIENT-INTEGRATION.md:
  • The claims table separates user and service-account (client_credentials) tokens: sub = app:<id>, scope, aud under AUDIENCE_MODE=dual since Socrate v1.13.0, plus auth_time and amr.
  • §4 covers RequireScopes.
  • The §7.1 BFF example uses bff.NewMemoryPendingLoginStore instead of a hand-written map, and compiles against the current API.
  • §8 fixes a snippet that didn't compile and completes the apierror constructor list.
  • Two FAQ entries: wrong audience, insufficient_scope.
• docs/MIGRATING-TO-SOCRATE.md: service-account tokens and RequireScopes.
• CONTRIBUTING.md: names the CI jobs.
• bff/pending_login.go: a doc comment named a non-existent SafeRedirect; it's SanitizeReturnTo. Comment only.

Checked and already correct: every package, conformance included, has a README table row and a reference section; the Go floor and toolchain versions are right everywhere.

How it was tested

• go build ./..., go vet ./... and gofmt are clean (the only Go change is a comment)
• The rewritten BFF example compiles against the current API
• Every relative link and anchor in the changed files resolves
• go test / golangci-lint / govulncheck: CI runs them; no code change
• A line is added under ## [Unreleased] in CHANGELOG.md

Compatibility

• Exported-API change: no.
• Behaviour change for existing callers: none.
• Breaking change: none.

This PR and the v1.26.1 release PR (#122) both touch CHANGELOG.md. Whichever merges second will need main merged in, and I'll do that.

🤖 Generated with Claude Code

https://claude.ai/code/session_01GKRxaeYxyDhmt42cehLsGA

---

Generated by Claude Code