docs: Fix migration tag example, cookie-auth example, and config reference gaps

[FXschwartz]

Three small 4.0 corrections

• Migration tag (docs: Upgrade guide migration command uses a tag the CLI rejects #792): the upgrade guide's --tag "upgrade-4.0" is rejected by the CLI because tags allow only lowercase letters, numbers, and dashes. Example changed to upgrade-4-0; the rule is now stated on the migrations page and the create migration intro.
• Cookie-auth example (docs: Cookie-auth config example silently leaves cookie auth disabled #793): the authCookie: block had only a commented-out child, which YAML reads as null, so cookie auth stayed disabled. Verified by running the YAML through ServerpodConfig.loadFromMap on rc.2. The example now sets sameSite: lax, the page says any single field enables the section, and the resulting client StateError is listed under verify.
• Configuration reference (docs: Configuration reference omits allowedOrigins and the authCookie keys #804): adds allowedOrigins and the six authCookie.* keys with env vars and defaults, and corrects the redis.enabled default (true when a redis section is present).

Markdown lint passes on all changed files.

Fixes #792, fixes #793, fixes #804.