docs: state that withClaims is not an auth gate

[mandarini]

withClaims never rejects a request that has no token, so [withClaims(), withSupabaseClient()] reads like the composable form of withSupabase({ auth: 'user' }) but accepts anonymous callers, and the mistake is silent: it compiles and passes a logged-in smoke test. This PR makes the docs say so before first publish: an explicit callout in the withClaims docstring, a note in the standalone pipeline section of docs/postgres.md, and a new middleware/claims section in the API reference, each pointing at withSupabase({ auth: 'user' }) as the actual gate. The wrapped-entry snippet is the form verified to typecheck under this repo's strict config; the bare wrapper from SDK-1596 conflicts with typed entries placed after it in a pipeline. Docs only, no behavior change; best merged after #124 so the gate recommendation never sits ahead of the lazy admin client fix.

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/@supabase/server@125

commit: 4fd2f8a