docs: guide for shared sessions across subdomains

[sea-snake]

Stacked on #149 (configurable storage).

A guide explaining how to share one sign-in across sibling subdomains of a single domain:

• derivationOrigin for a shared principal, plus CookieDelegationStorage (via the new delegationStorage option) to share the sign-in state.
• A silent prompt: 'none' acquisition on page load, using the hint cookie's announced principal (CookieDelegationStorage.readHint()) as hint.
• Reacting to cross-tab and cross-subdomain session changes with AuthClient.subscribe, and releasing the listener with unsubscribe() / dispose().

Supersedes #147 (built on the old storage API — used the removed syncStorage option and KEY_STORAGE_DELEGATION).

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Adds a new documentation guide describing how to share a single Internet Identity session across sibling subdomains, using the new configurable delegation storage APIs introduced in #149, and wires it into the docs sidebar.

Changes:

• New guide: shared sessions across subdomains (derivationOrigin + SyncCookieStorage + silent prompt: 'none' acquisition with hint).
• Documents reacting to session changes via AuthClient.subscribe() and cleanup via unsubscribe() / dispose().
• Adds the guide to the docs sidebar under a new “Guides” section.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
docs/src/content/docs/shared-sessions.md	Adds an end-to-end guide for cross-subdomain shared sessions (configuration, sign-in/out, silent acquisition, subscriptions).
docs/src/content/docs/_sidebar.json	Exposes the new guide in navigation under “Guides”.

Suppressed comments (2)

docs/src/content/docs/shared-sessions.md:61

• With transport: 'redirect', signIn() must run on page load so the flow can replay and complete on the return redirect. The current example starts signIn() from a click handler, which means the return load may never re-run signIn() and the session won’t be established.

document.querySelector('#signin').onclick = () => {
  new AuthClient({ ...shared, prompt: 'login' }).signIn();
};

docs/src/content/docs/shared-sessions.md:97

• This overpromises cross-subdomain propagation: SyncCookieStorage.subscribe() can notify immediately only via the Cookie Store API; otherwise it re-checks on visibilitychange/pageshow, so an always-visible tab may not update until it becomes visible again.

`AuthClient.subscribe` fires when the session changes elsewhere, so an open page
can update without a reload. A sign-out on any subdomain, or a sign-in in another
tab of the same origin, reaches every subscribed client.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.