[2.1 Docs] Auth & Deployment: Email-first identity (breaking) + FIPS mode #528

Summary
Two deployment/auth changes, one breaking. No UI images.

Work

• Email-first user identity management — document email as the primary user identifier and the upgrade/migration behavior. Breaking — belongs in deployment/upgrade/breaking-changes/ and the auth docs. (#25538)
• FIPS-mode compatibility for ingestion — document running ingestion in FIPS mode (no "FIPS" content exists in the snapshot today). Target deployment/. (#33261)

Acceptance criteria

• Email-first documented with the exact upgrade behavior and any admin action required.
• FIPS requirements/steps documented and verified against the PR.

Tracked as J17 in the 2.1 docs issue plan (release/2.1-changelog/). major-watcher markers above enable Major Release Watcher dedup.