README: document auth setup, troubleshooting, and the declared maturity level

Checklist items [B]:

Authentication setup is documented (if applicable)
Troubleshooting section covers common failure modes
Upstream chart values that users need to customize are documented

Plus a promotion requirement: the README must state the pack's declared maturity level, and it currently doesn't mention one anywhere.

Auth setup today lives in values.yaml comments and a commented-out GenericOAuthenticator block; the README only mentions dummy auth. Needs a section covering the Keycloak path: operator-provisioned OIDC client, the *-oidc-client secret convention, enforceAtGateway: false rationale, and the rbac bootstrap job.

The values.yaml comments already contain most of a troubleshooting section, it just needs to be surfaced:

• extraVolumes/extraVolumeMounts override silently dropping custom config (falls back to dummy auth)
• "400 OAuth state mismatch" from KC-initiated SSO without hubExternalUrl
• NFSv4 export broken on overlayfs nodes (kind/k3d), fixed with mountOptions: ["nfsvers=3"]
• jhub-app-proxy must be >= v0.2.3 for pixi/nebi env activation
• jhub-apps CrashLoopBackOff when service_workers > 1

Part of #120. Related: #87 (end user workflow docs).

Start with README and the authentication and troubleshooting comments in values.yaml, including the commented-out GenericAuthenticator block. Document the Keycloak path, required chart values, listed failure modes, and the pack's declared maturity level. Done means the README covers every checklist item and matches the existing values.yaml guidance.