fix(docs): authenticate-users backend example missing domain validation — vulnerable to cross-domain replay attack

## Security Issue

File: docs/base-account/guides/authenticate-users.mdx
Section: Backend (Viem) and Example Express Server

The backend verification example only checks the signature, not the SIWE message domain:

```ts
const valid = await client.verifyMessage({ address, message, signature });
```

This is insufficient. A valid SIWE signature created for `evil.com` can be submitted to `yourapp.com`'s `/auth/verify` endpoint and will pass verification, because `verifyMessage` only checks the cryptographic signature — not whether the message was intended for this domain.

## EIP-4361 Requirement

EIP-4361 explicitly requires the relying party to validate the `domain` field against the expected host:

> "The full SIWE message MUST be checked for conformance... checked against expected values after parsing (e.g., expiration-time, nonce, request-uri, domain etc.)"

## Expected Fix

Parse the SIWE message and validate the `domain` field before accepting the signature:

```ts
import { parseSiweMessage } from 'viem/siwe';

const siweMessage = parseSiweMessage(message);
if (siweMessage.domain !== 'yourapp.com') {
return res.status(400).json({ error: 'Domain mismatch' });
}
```

Or use viem's built-in `verifySiweMessage` which handles domain, nonce, and expiry validation together:

```ts
import { verifySiweMessage } from 'viem/siwe';

const valid = await verifySiweMessage(client, {
address,
message,
signature,
domain: 'yourapp.com',
nonce,
});
```

## Impact

Developers following this guide verbatim will ship authentication endpoints vulnerable to cross-domain replay attacks.

## References

- EIP-4361 spec: https://eips.ethereum.org/EIPS/eip-4361
- viem verifySiweMessage: https://viem.sh/docs/siwe/actions/verifySiweMessage