docs: document OIDC secret structure, app-native OAuth, and wrap-chart gotchas

[dcmcand]

Summary

Adds documentation based on real-world experience building the nebari-superset-pack. These are gaps and gotchas discovered during that process.

Changes

docs/auth-flow.md:

• Document the full OIDC secret structure: client-id, client-secret, issuer-url, spa-client-id, device-client-id
• Document the client ID naming convention (<namespace>-<nebariapp-name>)
• Document the auto-created RBAC resources (Role + RoleBinding for secret access)
• Add comprehensive "App-Native OAuth" section covering:
  • Gateway-only auth vs app-native auth vs dual-layer auth patterns
  • Concrete extraEnvRaw / valueFrom.secretKeyRef wiring examples
  • OIDC discovery URL construction from issuer-url
  • extraEnv vs extraEnvRaw guidance
  • Reference to nebari-superset-pack as a working example

docs/nebariapp-crd-reference.md:

• Update provisionClient description with client ID naming convention and link to secret structure docs
• Update enforceAtGateway description with link to app-native OAuth docs
• Update clientSecretRef description to mention issuer-url key

examples/wrap-existing-chart/README.md:

• Add "Discovering the upstream service name" section with helm template verification
• Add "Wrapping charts with Bitnami sub-dependencies" warning about the paywall
• Add "Sub-chart values are static" note about template expression limitation
• Add "App-native OAuth for RBAC" cross-reference

Test plan

• Verify all markdown links resolve correctly
• Verify the OIDC secret structure matches the operator source code
• Review wrap-existing-chart README for clarity

Closes #4, closes #5, closes #6, closes #7, closes #9