Clean up the auth notebooks

@alukach and I (mostly/completely Anthony) JFDI'd **stac-auth-proxy** into the workshop via notebooks 6-8, for use at FOSS4G Japan 2026. It went well, but there's some cleanup we should do:

- Go through everything to make sure it works — stuff fell over when we got to the Alice and Bob section of collection-level auth
- Do another iteration of the explanation section, probably with some diagrams — Anthony did a a great job explaining but he did have to wave his hands a fair bit, and it might be trickier for someone who is less familiar with **stac-auth-proxy**
- Right now, the **stac-auth-proxy** section requires running the workshop via local docker (not the binder notebook) — we should figure out if there's a way to make it work for the remote version, and if not call things out in the docs as clearly as possible so folks don't get confused

Start by running notebooks 6-8, checking the Alice and Bob collection-level authorization flow in the local Docker setup and the Binder version. Review the explanation sections for places that need diagrams or clearer context about stac-auth-proxy. Done means the notebooks work, the explanation is understandable to newcomers, and any Binder limitation is clearly documented.

Written by the indexing model from the issue text.