docs(auth): AUTHENTICATION_RBAC.md documents a retired 'Single-User Mode' auth bypass that no longer exists #16839

Problem

docs/developer/AUTHENTICATION_RBAC.md's "Single-User Mode" section (lines 275-286) and its Environment Variables table document AUTOBOT_SINGLE_USER_MODE (default true) as bypassing all authentication ("All requests are treated as admin / No authentication required / Permission checks are bypassed").

This mechanism does not exist in current code. grep -rn AUTOBOT_SINGLE_USER_MODE across all of autobot-backend/ (including tests) returns zero hits. security_layer.py:151-153 states explicitly: "Authentication is always derived from security_config; there is no single-user bypass (#10713, #10636)."

The doc contradicts itself: a later section, "Deployment Modes (correction, Issue #15737)" (lines 429-445), documents the retirement of a different, user-management-specific single_user/multi_user mode, but never touches or removes the earlier auth-bypass section.

Impact

Anyone reading AUTHENTICATION_RBAC.md today would believe an env var exists that disables authentication entirely. It doesn't (good — the bypass was correctly retired), but the doc still describes it as current behavior.

Acceptance criteria

• Delete or correct the "Single-User Mode" section (lines 275-286) and its AUTOBOT_SINGLE_USER_MODE table row in docs/developer/AUTHENTICATION_RBAC.md — the bypass was retired in infra(single-box): single_company backend cannot be provisioned without breaking SLM Postgres (pg_hba is single-user) #10636/arch: reconcile single_user auth-disable — #10636 retired it, #10666 revived it #10713 and no longer exists.
• Reconcile with the existing "Deployment Modes (correction, Issue security(auth): the authorization posture of user-management routes is not legible from the code #15737)" section so the doc doesn't describe two different retired single-user mechanisms inconsistently.

Related

Part of #16835 (control-plane map). Found verifying the Authentication layer against current code.