docs(ep-commerce): auth documentation drift — README cookie table, handler mounting, field-guide session concept

[field123]

Problem

The written record contradicts the code (post-#273 better-auth cutover):

• Package README still documents the pre-EP Commerce: replace hand-rolled session auth with stateless better-auth plugin #273 three-cookie architecture (ep_token, ep_account, accountStatus) — none of which exist. It also shows toNextJsHandler(epAuth); the working form is toNextJsHandler(epAuth.handler)
• Field Guide artifact, "Tokens, cookies & sessions" concept: shows the old three-cookie table while its own Chapter 1 correctly describes better-auth — the document contradicts itself
• COMPONENTS.md carries pre-cutover session references

Fix

• Rewrite the README auth/session section to match the current architecture (cookie pair + ep_checkout_session; correct handler mounting; /api/ep/ep/* URL shape)
• Fix the Field Guide's session concept section (three-cookie table → two-layer model)
• Sweep COMPONENTS.md for stale session references
• Cross-link both documents to the session internals guide so there is one explanation-of-record

Reference for the correct model: the "EP Session System — Internals Guide" (invariants, boundary map, seven HTTP flows).