docs: vendor the documentation site into the monorepo

Fold the standalone 3x-ui-docs project (Next.js 16 + Fumadocs, deployed to
docs.sanaei.dev) into docs/ so the panel and its documentation share a single
source of truth, the way sing-box keeps its docs in-tree. The old repo becomes
redundant and can be retired.

- Import the full site under docs/ (app, components, content, lib, public,
  scripts, config). The self-contained pnpm project sits alongside the existing
  engineering notes with no filename collisions.
- Re-point "Edit on GitHub" links from MHSanaei/3x-ui-docs to this repo's
  docs/content/docs path (docs/lib/shared.ts, docs/app/.../page.tsx).
- Add docs-ci.yml and docs-deploy.yml under .github/workflows/, scoped to
  docs/** and run with working-directory: docs, since GitHub only runs
  workflows from the repo-root .github/. deploy-static.yml's GitHub Pages
  publish (CNAME docs.sanaei.dev) carries over unchanged.

Follow-up (outside this commit): attach the docs.sanaei.dev custom domain to
this repository's Pages (or set the Vercel project's root directory to docs),
confirm the site is live from the monorepo, then delete MHSanaei/3x-ui-docs.

docs/content/docs/en/reference/api/authentication.mdx

@@ -0,0 +1,74 @@
+---
+title: Authentication
+description: >-
+  Two authentication modes are supported. UI sessions use a cookie set by the
+  login endpoint. Programmatic clients (bots, scripts, remote panels)
+  authenticate with a Bearer token taken from Settings → Security → API Token.
+  Both work for every endpoint under /panel/api/*.
+full: true
+_openapi:
+  preload:
+    - ./public/openapi.json
+  toc:
+    - depth: 2
+      title: >-
+        Authenticate with username + password and receive a session cookie.
+        Required before any cookie-based API call.
+      url: >-
+        #authenticate-with-username--password-and-receive-a-session-cookie-required-before-any-cookie-based-api-call
+    - depth: 2
+      title: Clear the session cookie. Requires the CSRF header for browser sessions.
+      url: '#clear-the-session-cookie-requires-the-csrf-header-for-browser-sessions'
+    - depth: 2
+      title: >-
+        Mint a CSRF token for the current session. The SPA replays it in the
+        X-CSRF-Token header on unsafe requests. Bearer-token callers can skip
+        this — the middleware short-circuits CSRF for authenticated API
+        requests.
+      url: >-
+        #mint-a-csrf-token-for-the-current-session-the-spa-replays-it-in-the-x-csrf-token-header-on-unsafe-requests-bearer-token-callers-can-skip-this--the-middleware-short-circuits-csrf-for-authenticated-api-requests
+    - depth: 2
+      title: >-
+        Returns whether 2FA is enabled on the panel — used by the login page to
+        decide whether to show the OTP field.
+      url: >-
+        #returns-whether-2fa-is-enabled-on-the-panel--used-by-the-login-page-to-decide-whether-to-show-the-otp-field
+  structuredData:
+    headings:
+      - content: >-
+          Authenticate with username + password and receive a session cookie.
+          Required before any cookie-based API call.
+        id: >-
+          authenticate-with-username--password-and-receive-a-session-cookie-required-before-any-cookie-based-api-call
+      - content: >-
+          Clear the session cookie. Requires the CSRF header for browser
+          sessions.
+        id: clear-the-session-cookie-requires-the-csrf-header-for-browser-sessions
+      - content: >-
+          Mint a CSRF token for the current session. The SPA replays it in the
+          X-CSRF-Token header on unsafe requests. Bearer-token callers can skip
+          this — the middleware short-circuits CSRF for authenticated API
+          requests.
+        id: >-
+          mint-a-csrf-token-for-the-current-session-the-spa-replays-it-in-the-x-csrf-token-header-on-unsafe-requests-bearer-token-callers-can-skip-this--the-middleware-short-circuits-csrf-for-authenticated-api-requests
+      - content: >-
+          Returns whether 2FA is enabled on the panel — used by the login page
+          to decide whether to show the OTP field.
+        id: >-
+          returns-whether-2fa-is-enabled-on-the-panel--used-by-the-login-page-to-decide-whether-to-show-the-otp-field
+    contents: []
+---
+
+{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}
+
+export default function Layout(props) {
+  const { APIPage, OpenAPIPage } = props.components ?? {};
+  // "APIPage" is the old name from v10, this allows both for backward compatibility
+  const Comp = OpenAPIPage ?? APIPage;
+  return (
+    <>
+      {props.children}
+      <Comp document="./public/openapi.json" webhooks={[]} operations={[{"path":"/login","method":"post"},{"path":"/logout","method":"post"},{"path":"/csrf-token","method":"get"},{"path":"/getTwoFactorEnable","method":"post"}]} showTitle />
+    </>
+  );
+}