docs: clarify session and auth middleware order

[oxura]

The panic correctly indicates that the session extension is missing, but the old suggestion to “add SessionMiddleware” is misleading when both middlewares are already present in the wrong builder order.

The diagnostic now explains both cases: add SessionMiddleware, and when authentication is enabled, register it after AuthMiddleware. The RootHandlerBuilder::middleware API docs, AuthMiddleware example, and project introduction now explain the wrapping rule: later registrations run earlier for each request. The panic regression pins the actionable wording.

Verification:

• focused middleware panic regression: 1 passed
• Cot library suite with all features: 555 passed, 36 ignored
• Cot doctests with all features: 696 passed, 3 ignored
• cargo +1.94.0 fmt --all -- --check
• Cot Clippy across all targets/features with warnings denied (unknown-lints allowed because Clippy 1.94 predates an upstream lint)

Closes #276.