docs(16.3-03): ExampleResolveBackend for plugin token auth

- Add compiled ResolveBackend example with acme.blog cover
- Include src= fence in authentication docs (Bearer-only)

Co-authored-by: Cursor <cursoragent@cursor.com>

modules/cabana/example_tokens_test.go

@@ -0,0 +1,41 @@
+package cabana_test
+
+import (
+	"errors"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+
+	"git.golem15.com/golem15/summercms/modules/backpack"
+	"git.golem15.com/golem15/summercms/modules/cabana"
+)
+
+// ExampleResolveBackend shows a plugin handler that accepts an admin JWT or
+// personal API token through cabana.ResolveBackend. The resolver reads only
+// the Authorization Bearer header (never the admin cookie).
+func ExampleResolveBackend() {
+	handler := func(app *backpack.App, w http.ResponseWriter, r *http.Request) {
+		_, _, err := cabana.ResolveBackend(app, r, "acme.blog.*")
+		if err != nil {
+			if errors.Is(err, cabana.ErrTokenScope) {
+				w.Header().Set("Content-Type", "application/json")
+				w.WriteHeader(http.StatusForbidden)
+				fmt.Fprint(w, `{"error":"Insufficient permissions"}`)
+				return
+			}
+			w.Header().Set("Content-Type", "application/json")
+			w.WriteHeader(http.StatusUnauthorized)
+			fmt.Fprint(w, `{"error":"Authentication required"}`)
+			return
+		}
+		w.WriteHeader(http.StatusOK)
+	}
+
+	rec := httptest.NewRecorder()
+	r := httptest.NewRequest(http.MethodPost, "/_blog/api/v1/posts", nil)
+	r.Header.Set("Authorization", "Bearer unused")
+	handler(nil, rec, r)
+	fmt.Println(rec.Code, rec.Body.String())
+	// Output:
+	// 401 {"error":"Authentication required"}
+}