docs: cpex-plugin.md example uses ghost fields that fail strict-decode

The problem

authbridge/docs/cpex-plugin.md's primary Configuration example puts apl: and pipelines: as top-level keys under the plugin's config: block:

plugins:
  - name: cpex
    config:
      hooks:
        on_request:
          - cmf.tool_pre_invoke
      apl:               # <-- not a real field
        identity:
          jwt: ...
      pipelines:         # <-- not a real field
        cmf.tool_pre_invoke:
          - pdp/cedar-direct

The actual config struct (authbridge/authlib/plugins/cpex/config.go) has no apl or pipelines fields. The struct's field for CPEX YAML is config (inline string) or config_file (path); should the apl: / pipelines: content belong there?

Suggested fix

1. Rewrite the primary example so the CPEX YAML is nested inside config: (inline) OR reference config_file: and show the CPEX YAML separately.
2. Add a reference table like other plugin docs, distinguishing AuthBridge-side fields (hooks, fail_open, worker_threads, bypass_*) from the CPEX YAML delivery mechanism (config vs config_file).
3. Cross-reference CPEX's own docs for the CPEX YAML schema — that's the source of truth for what goes inside config:.

Start with authbridge/docs/cpex-plugin.md and compare its example with the CPEX config struct in authbridge/authlib/plugins/cpex/config.go. Rewrite the example to use inline config or config_file, add the requested field reference table, and link to CPEX's documentation for its YAML schema. Done means the example matches the struct and clearly separates AuthBridge fields from CPEX YAML.