docs: clarify authentication and header propagation patterns

[however-yir]

Summary

Clarify the common authorization and header-propagation patterns around the SDK.

Why

The README already explains that authorization is pluggable, but readers still benefit from a short explanation of where inbound auth belongs and how outbound header propagation should usually be handled. This is especially helpful for framework-integrated deployments.

Scope

• expand the authorization section in README.md
• describe common inbound auth and outbound header-propagation patterns at a high level
• keep the guidance explicit about framework responsibilities versus SDK responsibilities

Testing

• documentation-only changes
• reviewed the wording against the current transport and authorization positioning in the repository docs