Embedded signing docs say verification is required; API allows none and docs elsewhere agree #215

Related PRs

• docs(turbosign): say embedded verification is recommended, not enforced #218 (docs: verification is recommended, not enforced)

What's wrong

docs/TurboSign/embedded-signing/index.md:52 and build/_setup-and-verify.mdx:3 (included in every build guide) say: "Every embedded signer needs a verification method, unless you use the sender override while testing."

The API doesn't enforce this, by design. On an org whose "When to verify signers" is "Only when requested" (default channel none), a recipient with no auth/otpChannel resolves to no verification, and createSigningUrl returns a reusable link for it. This was a deliberate product decision, and our own docs already say so elsewhere: identity-verification/index.md:63-65 ("If you leave verification off a recipient (and your organization verifies only when requested), TurboSign still issues a signing URL, and whoever opens it can sign") and embedded-signing/reference.md:142 ("otp or no verification").

Impact

• A developer reading "needs" assumes TurboSign will reject a recipient with no verification. It won't, so a forgotten auth silently yields an unprotected, reusable signing link.
• It also confuses anyone who sees a no-passcode embedded flow on such an org.

Suggested fix

• Reword both spots to say verification is strongly recommended, not enforced, e.g. "If you set no verification and your org verifies only when requested, TurboSign still issues a reusable link that anyone holding it can use."
• Link to the caution in identity-verification/index.md.
• Mention that an org set to "On every signature request" applies its default method.

Severity: S3. Found while building the embedded-signing how-to videos on an org that verifies only when requested; verified against the backend and Docs origin/main.