[Bccorb]

Closes #117.

Adds understand/oauth-rfc9700.mdx and links it from the security posture page (the OAuth threat row and Related Docs).

• Every client recommendation in RFC 9700 that applies to the API, with a status and a link to the code at the v0.19.1 tag (and @seamless-auth/types v0.28.0 for the request and provider schemas).
• Authorization server rows listed as "applies from v0.21", not scored.
• The per-instance state replay cache (fix(oauth): share the OAuth state replay cache across instances seamless-auth-api#414) is listed as partial.

Writing the matrix turned up one real gap: the OAuth state is not bound to the client that started the sign-in (login CSRF, RFC 9700 section 4.7). It is filed as fells-code/seamless-auth-api#463 and fixed in fells-code/seamless-auth-api#465 with fells-code/seamless-auth-types#104 and the SDK PR. The row says "Gap" with a caution note; once the fix is released the row should be updated to point at the release tag.

Other rows that are not a clean pass, stated as such on the page: mix-up (no iss check, shared default redirect URI), client authentication (client_secret_post only), sender-constrained tokens (not used), TLS on provider URLs (not enforced by the schema).

Checks: npm run lint clean, npm run typecheck 0 errors, npm run build 56 pages built (only the existing env language and empty i18n warnings).