Add API-based authentication lifecycle section

[Alvi24-hub]

This PR introduces a new subsection titled:

"Where Authentication Decisions Should Occur in an API-Based System"

The goal is to provide architectural context for API-first systems by describing:

• A simplified API authentication request lifecycle
• Where authentication and authorization decisions occur
• Separation of login, middleware, and risk-based controls

This change does not modify any existing recommendations.
It connects existing guidance into a clearer architectural model.

Additional responsibility breakdown (login endpoint, middleware, token refresh, risk escalation) will be submitted in follow-up PRs.

Part of #2013