Document a concrete auth design for the deferred permissions work

Planning only, no code yet. Per-role PIN codes (not named accounts - a shared
trackside laptop doesn't want individual logins), an optional IP/host allowlist as a
separate complementary layer, and 2FA deliberately left out unless a club actually
exposes the server past their own LAN. Flags one open question for the user to decide
before implementation starts: auth off by default vs. on by default with an
auto-generated Admin PIN on first run.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

package.json

@@ -1,6 +1,6 @@
 {
   "name": "rc-racecore",
-  "version": "1.21.1",
+  "version": "1.21.2",
   "private": true,
   "description": "RC RaceCore live timing and race control with AMMC ingest and SQLite persistence",
   "engines": {