docs: wave 11 accepted; SPEC records auth refresh + why the 404 rule needs it

HANDOFF: expired-token incident, local data loss, verification incl. live
sync against the public URL, phone recovery path, HAZARD #12 (slow storage).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

logs/CHAIN-DONE

@@ -1 +1 @@
-chain complete 2026-09-15T18:28:39+00:00
+chain complete 2026-09-17T02:54:43+00:00

logs/WAVE11-DONE

@@ -0,0 +1,4 @@
+=== WAVE 11 (M-authexpiry) passed the chain gate 2026-09-17T02:54:43+00:00 ===
+commit 009cb9a (pushed); tests 355; worker $4.886013000000001, 123 turns
+Mechanical gate only. Orchestrator must still review: read logs/M-authexpiry.summary,
+eyeball new Paparazzi PNGs, and read the diff (git show --stat 009cb9a).