Add the CTX spend-api pubkey auth design doc

Documents the protocol as implemented: the wire format, where the keypair
lives and why, the token lifecycle, and the decisions behind each, including
the two places the reference script's crypto could not be copied verbatim.

Author: j0ntz