docs: add SEP-10 authentication guide

[Deywumi-debug]

Summary

Adds docs/sep10-auth.md — a dedicated guide explaining the SEP-10 challenge-response authentication flow used in VacciChain.

What's included

• Why SEP-10 is used (no password DB, wallet-based identity, replay protection)
• Step-by-step flow diagram (client → backend → Stellar Network)
• Challenge transaction structure (sequence 0, time bounds, manage_data ops, nonce)
• Replay protection details: nonce store (single-use + 5 min TTL) and transaction time bounds
• Ordered verification steps performed by verifyChallenge
• JWT issuance: role derivation, claims, key rotation, audit logging, brute-force guard
• Rate limiting and relevant source file index

Files changed

• docs/sep10-auth.md (new file, 126 lines)

Testing

Documentation only — no code changes.