feat: add golfers.getFollowing() + fix auth docs from real-world GHIN integration

[Ryan4n6]

Summary

Adds the golfers.getFollowing() endpoint and significantly improves documentation based on real-world integration testing with a production Cloudflare Workers app.

New Feature

• golfers.getFollowing(ghinNumber) — Fetch the list of golfers a user is following (discovered via network traffic inspection on ghin.com)
• Zod schema for following response with full golfer fields
• Unit tests with mocked fetchCustomPath

Documentation Fixes (from real-world testing)

AUTHENTICATION.md — critical corrections:

• Fixed Step 1 endpoint: Was incorrectly documenting Firebase Identity Toolkit (identitytoolkit.googleapis.com/accounts:signInWithPassword), but the code actually uses Firebase Installations API (firebaseinstallations.googleapis.com/installations). These are completely different APIs.
• Documented all three working auth paths: Firebase+GHIN login (default), direct API login (apiAccess: true), and direct login without Firebase token
• Fixed broken markdown formatting (nested numbered lists rendered as indented code)
• Added D1 cache adapter example for serverless environments (Cloudflare Workers)
• Corrected token TTL documentation (variable JWT exp, not fixed 24h)

API_ENDPOINTS.md — corrections and additions:

• Fixed Get Course Details endpoint: Was GetCourse.json, actually GetCourseDetails.json (matches apiPathnames.course_details in source)
• Added full GetCourseDetails response example with hole-by-hole data (real data from Saddleback Golf Club, courseId 24279)
• Added breaking change notice: all GHIN API endpoints require auth as of 2026 (previously golfers/search.json worked unauthenticated)
• Fixed massive formatting bug: everything after "Following" section was accidentally in nested blockquotes
• Added combo tee set edge case documentation (empty Holes arrays on "Black/Gold" style tees)
• Added Male/Female tee set merging guidance
• Fixed course_handicaps endpoint path (playing_handicaps.json)
• Distinguished golfers/search.json from golfers.json endpoints

Code Quality

• Ran biome format on 3 existing .ts files with indent inconsistencies

Context

These findings come from integrating @spicygolf/ghin with the TPS League platform — a women's golf league management app (Cloudflare Workers + D1) that imports course data from GHIN for 39+ Colorado Front Range courses. The auth documentation discrepancies were discovered when the server-side GHIN proxy was built to handle token lifecycle for bulk course imports.

Test plan

• All existing tests pass (bun run test:run)
• New getFollowing() tests pass with mocked fetchCustomPath
• biome check clean (0 errors)
• tsc type check passes
• tsup build succeeds (CJS + ESM + DTS)
• Manual verification: Auth flow docs match src/client/request-client/index.ts implementation

🤖 Generated with Claude Code