fix: KEEP-1051 make docs generation actually run, and regenerate the reference

[suisuss]

Summary

go generate ./docs/ has been doing nothing. The //go:generate directive sat
in docs/generate.go, which carries //go:build ignore - the constraint
excludes the file from the build, so it is never scanned for directives. The
command exited 0 having generated nothing.

Two guards were vacuous as a result:

• docs-check compares the tree against itself and passes in ~16s no matter
  how far the reference has drifted.
• The release sync to keeperhub regenerates and then copies, so it published
  whatever stale pages happened to be committed.

Moving the directive into a compiled file (docs/doc.go) fixes both.

Scale of the drift this was hiding

Regenerating updates 55 pages and adds 15 that had never been written.
The reference goes from 58 to 72 command pages.

Among the missing: kh workflow resume - the only way to enable a workflow
from the CLI. Absent from the reference entirely, which is why it reads as a
capability the CLI does not have. The bulk of the 55 updates is the global
--org flag, missing from every page's inherited-flags list.

Two false statements corrected

The generator would have kept publishing both, and one had already reached
docs.keeperhub.com:

• kh auth login claimed it "opens a browser". It never does -
  internal/auth/device.go prints a URL and waits.
• The device-code expiry error told users to rerun with --no-browser, a flag
  the CLI has never had.

Sync workflow now fails loudly

Two guards, both chosen because the failure mode is a PR that looks
authoritative:

• Fail if a tag's committed docs do not match its own command tree, rather than
  copying stale pages.
• Fail if fewer pages are copied than generated. A partial copy publishes a
  reference where a missing command is indistinguishable from one that does not
  exist.

Verification

The change is only meaningful if the guard can now fail, so I tested that
directly rather than trusting the regeneration:

• Added a throwaway flag, ran go generate ./docs/ -> docs/kh_auth_login.md
  drifted (4 insertions), so git diff --exit-code docs/ fails. The
  identical experiment before this change produced nothing at all.
• Removed the flag, regenerated -> tree clean, so docs-check passes on a
  correct tree.
• go build, go vet, golangci-lint run ./... (0 issues), full go test -race ./... - no failures.

Note for reviewers

The diff is large but almost entirely generated output. The hand-written changes
are five files: docs/doc.go, docs/generate.go, cmd/auth/login.go,
internal/auth/device.go, and the sync workflow. Everything under docs/kh*.md
is generator output and should be reviewed by regenerating rather than by
reading.

Expect the next release sync to keeperhub to be large for the same reason - it
will carry the 14 command pages that repo has never had.