docs(blog): publish authentication call-graph migration

[TimeToBuildBob]

Summary

• publish “Authentication Is a Call-Graph Change” from today's ActivityWatch auth rollout audit
• explain request-surface enumeration, credential provenance, loopback semantics, and graceful 401 handling
• include the generated per-post OG image

Verification

• scoped website pre-commit checks pass
• make build passes after installing the locked bundle
• rendered page exists at /blog/authentication-is-a-call-graph-change/
• source frontmatter/content validation and collision check pass

Deliberate scope

This publishes the engineering lesson only. It does not claim the full ActivityWatch auth rollout is complete; the post explicitly frames remaining client edges as migration inventory.