Add Linux auth brute-force case study

[stacknil]

Summary

• add a forensic-style Linux auth brute-force case study
• explain raw evidence, normalization, detector rules, parser coverage, findings, warnings, false-positive boundaries, and non-goals
• keep reproduction as an evidence-artifact command rather than a tutorial walkthrough

Validation

• verified fixed section order requested by PR-L2
• verified referenced sample/report-contract paths exist
• ran whitespace check on origin/main...HEAD diff
• ran privacy/sensitive-string scan on the new document
• checked for tutorial/walkthrough wording in the new document