docs: client integration guide, admission-control scope, and README client library - #21

Documentation only — no behavior changes. Stacks on the multi-network PR (merge that first); it documents the session-recovery reconnect that PR adds.

There was no client-integration documentation anywhere: JOINING_SERVICE_API.md documents each endpoint in isolation and its example flows are all happy paths from a clean slate, and the README never mentioned JoiningClient. An app developer embedding the client had nothing telling them what to call on startup.

• New JOINING_SERVICE_API.md §4 "Client Integration" — the startup decision tree, decided entirely by local state: hApp installed → nothing to do; no agent key → generate and join; agent key present but hApp not installed → reconnect first, and only fall through to join on 403 agent_not_joined. Reconnect goes first because it needs only the key and a signature, while join may need claims, an invite code, or an interactive prompt — so a crashed install recovers silently and auth is surfaced only when the agent genuinely has to join something new. Also states, normatively, that clients persist the agent-key→hApp association before calling /v1/join: local-write-before-remote-call is orderable, the reverse is not, and getting it wrong burns an invite code (fatal with single-use codes).
• Security Considerations (§7) gains a scope statement: the service does admission control and does not prevent source-chain forks — anyone holding the private key can copy the whole conductor directory, so fork prevention is Holochain's job via validation and warrants. The 409 agent_already_joined is defended on its actual grounds (join requires no proof of key possession; the session token is a bearer credential for provision) rather than as a fork guard. Recorded so the "just make join idempotent" argument doesn't need re-litigating each time someone hits the 409.
• Reconnect replay window documented in the same section: the signed payload is the timestamp alone (default 300s tolerance) and ready sessions never expire, so a captured request replayed inside the window yields a session token, and that token stays usable indefinitely. Widening the signed payload to cover the agent key and a server-issued nonce is the durable fix — worth its own issue.
• New example flow for recovery after an interrupted install, and a README client-library section covering discovery, join, provision, and recovery with a typed startup example.

Two pre-existing inaccuracies fixed while in here: the security section claimed session expiry times that don't match the stores (ready sessions never expire; pending TTL default is 86400s), and one example flow showed a linker_urls_expire_at field that doesn't exist (real shape is per-entry expires_at).

Sections 4–9 renumber to 5–10 to make room for the new section; every cross-reference was audited (one moved reference updated, plus the src/types.ts header comment that names the types section — the only non-doc line in this PR).