Docs: undocumented bounds on session TTLs and a required org role #39

Found while building cadeom's config-JWT endpoint against UOA, verified in UOA source rather than inferred from behaviour.

Three constraints enforced in schema and absent from the guide:

• session.access_token_ttl_minutes is int().min(15).max(60). The 60-minute ceiling is undocumented. (long_refresh_token_ttl_days is 1–90.)
• org_features.org_roles must contain "owner" — a zod .refine, not mentioned anywhere.
• PublicRsaJwkSchema is .passthrough(), so extra JWK members are accepted; only d,p,q,dp,dq,qi,oth are rejected. The guide describes the key shape as exact members only, which is stricter than reality.

Each is only discoverable by having a config JWT rejected and reading the source.

Ask: put the numeric bounds and the required role in the config reference.