docs: Correct the legacy Authentication pages for 4.0

[developerjamiu]

Final PR of the Authentication section pass, following #728, #729, and #731. This one covers the legacy section, the two upgrading guides, and two small consistency follow-ups from #731.

Legacy pages (correctness only, no restructuring)

Every claim on the nine legacy pages was verified against the framework source. The legacy serverpod_auth module still ships at 4.0.0-beta.1 (relocated to modules/legacy/ in the monorepo), so the pages are corrected to match that release:

• Removed APIs are no longer documented as callable. The signOut method and status endpoint were removed in 3.0; the info boxes now say so and point at signOutDevice/signOutAllDevices. The legacyUserSignOutBehavior config row is gone. Client snippets assign the key manager to the authKeyProvider field instead of the removed constructor parameter.
• Non-compiling snippets fixed: AuthenticationInfo calls (String identifier, required authId), UserAuthentication.signInUser (missing Session argument), the passwordHashValidator/passwordHashGenerator examples (current signature and PasswordValidationResult), the Apple button import (pointed at the email package), stale awaits on the now-synchronous session.authenticated and isUserSignedIn getters, and import standardization on the serverpod_auth_server.dart entrypoint.
• Wrong defaults corrected: passwordResetExpirationTime is 15 minutes (was documented as 24h), allowUnsecureRandom defaults to the safe behavior (the page described the opposite), validationCodeLength documents the real warn-below-8/throw-below-4 behavior, and the firebase key path and image-generator defaults are filled in.
• Version pins: ^1.x.x pins replaced with 4.0.0-beta.1 across the section.
• Positioning and migration linking: the setup intro now presents the module as the legacy option for existing apps, points new projects to the current auth setup, and links the migration guide. The other eight pages carry a uniform migration note under the H1.

Upgrading guides

• Upgrade to 4.0 gains an "If you use the legacy auth module" subsection in the dependencies step: bump the serverpod_auth packages in lockstep, and move off the deprecated authenticationKeyManager parameter to authKeyProvider (deprecated at beta.1, removed after).
• Both upgrading pages now pin 4.0.0-beta.1 consistently (the migration guide previously told a freshly upgraded reader to downgrade back to beta.0), and the migration guide's SDK prerequisites match the beta.1 minimums (Dart 3.10.3, Flutter 3.38.4).

Follow-ups from #731

• Firebase's configuration page is renamed from "Customizations" to "Configuration" (file, sidebar label, and H1), matching email, so "Customizations" consistently means the merged config-plus-UI scope across providers. The old URL's redirect is queued for the GA cutover with the rest.
• Platform casing: "web" is lowercased in platform lists and prose across the section, while console UI labels, Google's "Web application" OAuth client type, and sentence-initial uses stay capitalized.