docs(web): update auth.go comments for multi-user reality (ADR-012)

Package comment said "Stage-0 ... (ADR-011)" and User.Subject said
"single-user allowlist (ADR-011)". Both stale: ADR-012 opened Stage 1
(multi-user, RLS-enforced isolation). Subject is now the user_identities
lookup key (migration 004) resolving to a per-user UUID; an unknown
subject hits the registration gate.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

internal/web/auth.go

@@ -1,6 +1,7 @@
-// Package web is the Stage-0 HTTP read/write surface (ADR-011, docs/ui-spec.md).
+// Package web is the multi-user HTTP read/write surface (ADR-012, docs/ui-spec.md).
 // It serves the summary reader over the existing store; the engine and ports are
-// untouched (ADR-003).
+// untouched (ADR-003). ADR-011 shipped this as a single-user Stage-0 reader; ADR-012
+// opened Stage 1 — multiple Dex-authenticated users with DB-enforced (RLS) isolation.
 //
 // This file defines the auth SEAM so the Dex session layer (internal/web/oidc)
 // and the page/handler layer can be built independently: handlers depend only on
@@ -10,9 +11,10 @@ package web
 
 import "net/http"
 
-// User is the authenticated principal. Subject is the Dex subject used for the
-// single-user allowlist (ADR-011); store operations key off the configured
-// tapir user_id (UUID), not this subject.
+// User is the authenticated principal. Subject is the Dex subject — the key for the
+// user_identities lookup (ADR-012) that resolves to a tapir user_id (UUID); store
+// operations scope every row by that id, not by this subject. A subject with no
+// users row is routed through the registration gate (see registration.go).
 type User struct {
 	Subject string
 	Email   string