docs(auth): enforce nine-byte contract for client_id with MUST-level language

[VasilevNStas]

Description

Strengthens the documentation for Auth.client_id to explicitly state that the field MUST be exactly nine bytes and that implementations MUST validate this length before HMAC computation or verification.

Problem

Auth.client_id is declared as bytes with no proto-level length constraint. The comment said "exactly nine raw UTF-8 bytes" as a description, not a requirement. The HMAC covers (client_id || timestamp), so a non-nine-byte value verifies cleanly as long as both sides use the same wrong-length bytes — the nine-byte identity contract is silently unenforced.

Changes

• client_id comment rewritten: "MUST be exactly nine bytes", explicit warning about HMAC passing with wrong lengths, validation requirement for both sender and receiver.
• hmac comment updated: "Implementations MUST verify client_id is exactly 9 bytes before computing or checking this tag."

The underlying issue (no schema-level enforcement) cannot be fully fixed without protoc-gen-validate or a custom plugin, but this makes the contract unmistakable.

Closes #13

[VasilevNStas]

@davvd please review

[davvd]

@VasilevNStas we have merge conflicts here, please resolve them and we'll merge

[VasilevNStas]

@davvd conflicts resolved.