docs: publish every guide in English and bring them up to date

[allen0099]

Part of #81.

What

• Translated to English: CACHE_FLOW.md, JWT_CLAIMS.md, SESSION.md and STATE.md were fully or partly Chinese. While rewriting them, every claim and example was checked against the code; the corrections are listed below.
• Updated for accuracy: README.md, DEVELOPMENT.md and CONTRIBUTING.md. DEVELOPMENT.md gains a section on building the docs site and adding API pages.
• Chinese README: docs/README.zh-TW.md leaves the site navigation. It stays in the repo, and the README language switcher still links to it on GitHub. A proper zh-TW translation can come later as a Read the Docs translation project.
• Callouts: every doc now uses GitHub's > [!NOTE] syntax. The markdown-callouts extension (a new docs-group dependency) renders them as admonitions on the site instead of printing a literal [!NOTE].

Corrections found against the code

JWT_CLAIMS

• The documented way to plug in a custom serializer, manager._token_serializer = ..., was silently ignored. The examples now pass token_serializer=.
• exp follows the session's expires_at, so it tracks sliding renewal. It falls back to iat + session_ttl only when no expires_at is set.
• get_session() returns (session, renewed_token).
• A bad token raises SessionTokenError, not ValueError.
• An example secret was shorter than the 32-character minimum.
• Only the HS* algorithms work with the built-in serializer.

SESSION

• jwt_leeway defaults to 0, not 60.
• The quick start added the middleware twice and was missing imports.
• Flash messages stay cleared only after update_session.
• There is no httpOnly option: the cookie is always HttpOnly.

CACHE_FLOW

• Non-GET responses get no Cache-Control header.
• clear_path() skips entries with query params unless include_params=True.
• Memcached clear() runs flush_all; it is not a no-op.
• no_cache=True still writes cache entries.
• Redis sets expiry with SET ... EX, not SETEX.

STATE

• A state already evicted by the backend TTL raises InvalidStateError, not StateExpiredError.
• get_state_manager() has no MemoryBackend fallback.

README

• /cached-hits lists the cached entries; it does not count hits.
• The Memcached limitations are now complete.

DEVELOPMENT

• tox covers Python 3.10–3.14.
• The opted-out coverage figures were re-measured.

Possible code issues found (not fixed here)

• jwt_algorithm accepts RS/ES/PS/EdDSA, but the serializer signs with the string secret_key, so those algorithms fail at encode time.
• Behind a trusted proxy, the IP bound to a session must come from X-Forwarded-For, but the helper that reads it (_get_client_ip) is private.
• StateManager.create_state documents StateDataError for backend failures that actually propagate unchanged.

Verification

• zensical build --strict: no issues.
• The rendered pages contain no literal [!NOTE]/[!WARNING].
• No Chinese characters remain outside README.zh-TW.md and the README language switcher.
• Pre-commit passes (the uv-lock hook was skipped because it upgrades unrelated packages). uv lock --check passes; the lockfile only gains markdown-callouts.
• The doc examples for JWT and sessions were run as scratch scripts under TestClient.