fix: use only the docs.truecalc.app token in BingSiteAuth.xml

[hhimanshu]

Problem

Bing rejects verification of https://docs.truecalc.app/ with:

Incorrect authentication key: please make sure the authentication file contains the
following verification key: 8C5913DDDB5710E055911488CB4A9E96

— even though the file did contain that key, and was served correctly:

$ curl -A "Mozilla/5.0 (compatible; bingbot/2.0; ...)" https://docs.truecalc.app/BingSiteAuth.xml
<?xml version="1.0"?>
<users>
	<user>4A2DF37AEACD708CD051F4D161C07367</user>
	<user>8C5913DDDB5710E055911488CB4A9E96</user>
</users>

Ruled out as causes: wrong content-type (application/xml ✅), stale CDN cache (last-modified
after deploy, retried past the 600s max-age), and user-agent cloaking (bingbot sees the same
bytes).

Bing reads the first <user> element rather than matching against all of them, so the older
token shadowed the one being verified. #58 appended the new token on the assumption that
multiple tokens are checked — that assumption was wrong.

Fix

Keep only the token for the site actually being verified.

<?xml version="1.0"?>
<users>
	<user>8C5913DDDB5710E055911488CB4A9E96</user>
</users>

Dropping the old token costs nothing: it verified https://truecalc.app/, whose apex has no
A, AAAA, or CNAME records, so Bing could never crawl that property and its verification was
inert.

$ dig +short truecalc.app A      # (empty)
$ curl https://truecalc.app/     # connection failed

How to test

After deploy:

curl -s https://docs.truecalc.app/BingSiteAuth.xml
# expect exactly one <user>: 8C5913DDDB5710E055911488CB4A9E96

Then Bing Webmaster Tools → https://docs.truecalc.app/ → Verify. Allow up to 10 minutes
for the previous response to fall out of cache (cache-control: max-age=600).

XML validated well-formed with a single-token assertion locally.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}