docs: cover the ii-app-metadata well-known file in the II guide

[aterga]

Summary

• Adds an App metadata section to docs/guides/authentication/internet-identity.mdx, between Alternative origins and Common mistakes, covering the /.well-known/ii-app-metadata document that lets an app supply its own name, description, and logo for the Internet Identity sign-in screens. Nothing in the guide covered it: until now the only way to get branded screens was to be in the curated list shipped inside II, which this mechanism replaces.
• Placement is deliberate. The section reuses the derivation origin the reader has just configured in Alternative origins (the document is fetched from the origin identities are derived for, so an app publishes it once and all of its alternative origins present the same way), and it extends the same .ic-assets.json5 with CORS entries for the document and the logo.
• Content covers what an integrator has to get right: the field limits (40 / 120 code points), the raster-only logo rules (same origin, no SVG, 1 MiB, 4096 px per side, re-encoded by II at up to 512 px), the 8 KiB document cap, 200 with no redirect, and the 10 second budget. It also states that a single invalid field drops the whole document and that II names the offending field in the browser console, since that is the first thing someone debugging missing metadata needs to know.
• Ends with a note that the metadata is exactly as trustworthy as the origin serving it and verifies nothing about the app, which is why II keeps the origin on screen next to it.

Structural decisions

• Heading level. Added as an ## section so it sits as a sibling of Alternative origins and Common mistakes rather than nesting under either. The mechanism is independent of alternative origins: apps that never set a derivationOrigin use it too.
• Spec link is internal and anchorless. Per the repo's linking rules this points at ../../references/internet-identity-spec.md rather than upstream GitHub. Worth knowing when sequencing this: that mirrored page does not carry the app metadata section yet, because .sources/internetidentity is pinned to a commit older than the upstream change (feat(fe): permissionless app metadata for the authorize flow internet-identity#4221, merged as f5b84b2). Bumping that submodule and running npm run sync:ii-spec pulls the section in, at which point the link can gain a #app-metadata anchor. That is a maintainer-scope submodule bump, so it is not part of this PR.

Verification

• node scripts/validate.js --all: no errors in the changed file. The 4 reported errors are pre-existing, in docs/guides/digital-assets/chain-key-tokens.mdx and docs/guides/backends/data-persistence.mdx, both untouched here.
• The page still compiles as MDX (checked with @mdx-js/mdx against the file body).
• npm run build was not run locally: .sources/ submodules are uninitialized in this environment and most are SSH remotes, so a build fails on unrelated pages that resolve snippets from them. CI's build_and_deploy covers it and is green, and the preview was checked in the browser: heading order is Local development → Alternative origins → App metadata → Common mistakes → Next steps, both JSON blocks render, and the spec link resolves.
• The :::note in the new section renders as a plain div rather than a styled callout. So does the page's pre-existing note under Alternative origins: the built page contains no starlight-aside elements at all, so this is existing site behaviour and not something this change introduces. Left as is to match the page; happy to open a separate issue if the directive handling should be fixed.
• Limits and behaviour in the text were taken from the merged implementation (src/frontend/src/lib/utils/appMetadata.ts in dfinity/internet-identity), not from memory.

[github-actions]

🤖 Here's your preview: https://mmsik-fiaaa-aaaam-ahq7a-cai.icp0.io