docs : expanded owner-scoping guidance in API authentication docs

[tmdeveloper007]

Closes #1103.

Summary of What Has Been Done:
Added an "Owner Scoping and Multi-Workspace Isolation" section to docs/api-authentication.md explaining how the X-User-Id header drives workspace isolation and how it relates to the shared deployment API key.

Changes Made:

• Added a two-layer identity model overview (authentication vs. authorization)
• Added resolution logic table showing how X-User-Id maps to owner_id
• Added concrete curl examples showing Alice and Bob workspaces using the same API key
• Added a security note emphasizing that X-User-Id must be set by a trusted upstream auth proxy
• Added a comparison table between API Key and X-User-Id headers

Impact it Made:

• Reduces support questions about workspace isolation and BOLA protection
• Documents the owner scoping model introduced to address issue Task and report APIs lack a user/owner authorization model #401
• Helps operators understand how to configure multi-tenant deployments correctly

Note: This task is being handled by tmdeveloper007 — please assign to that account when picking it up.

[utksh1]

Focused change with green checks; approving.