docs: Update documentation from JS, Dart, and Swift SDK changes (#48723)

## Summary

Updates docs based on recent SDK changes across three of the six tracked
SDKs. `supabase-py`, `supabase-kt`, and `supabase-csharp` were also
analyzed this cycle but had no doc-worthy changes (internal bug fixes /
dependency bumps only, or no new commits).

## Changes analyzed

| SDK | Repo | Commits | Latest tag |
|---|---|---|---|
| js | https://github.com/supabase/supabase-js | `485695ff7...21e410f56`
| v3.0.0-next.29 |
| dart | https://github.com/supabase/supabase-flutter |
`6979093...5447063` | yet_another_json_isolate-v2.1.1 |
| py | https://github.com/supabase/supabase-py | `3c98900...0490201` |
v3.0.0a1 |
| swift | https://github.com/supabase/supabase-swift |
`c24795d...51a083a` | v2.54.1 |
| kt | https://github.com/supabase-community/supabase-kt | (no new
commits) | 3.7.0 |
| csharp | https://github.com/supabase-community/supabase-csharp |
`572624e...ac057a2` | v1.5.0 |

## Documentation updates

- **`apps/docs/content/guides/auth/sessions/pkce-flow.mdx`** — new
"Overlapping flows" section documenting the experimental
`appendPkceFlowIdToRedirects` option and `flowId`-aware
`exchangeCodeForSession()`, added in supabase-js #2569, which fixes
concurrent PKCE flows (e.g. multiple tabs) clobbering each other's
stored code verifier.
- **`apps/docs/spec/supabase_dart_v2.yml`** — `stream()` entry:
documented the new filter methods (`like`, `ilike`, `match`, `imatch`,
`isFilter`, `isDistinct`) and multi-filter chaining added in
supabase-flutter #1610, plus two behavioral caveats (filter
re-evaluation on UPDATE, primary-key-only DELETE payloads) and a new
example.
- **`apps/docs/spec/supabase_swift_v2.yml`**:
- `invoke()` entry: documented the new `timeoutInterval` override on
`FunctionInvokeOptions` (supabase-swift #1144), with a new example.
- Added missing `generate-link` and `signOut()` (admin) spec entries —
supabase-swift #1152 added these methods but Swift had no reference
entries for them, even though the shared nav ids already existed in
`common-client-libs-sections.json` for other SDKs.

## Test plan

- [x] `python3 -c "import yaml; yaml.safe_load(...)"` on both edited
YAML spec files — parses cleanly
- [x] `npx prettier --check` on all three changed files — passes
- [ ] Visual check of rendered reference pages for the new Swift
`generate-link` / `signOut` / timeout examples and the Dart `stream()`
multi-filter example (docs dev server)

---

🤖 Generated with [Claude Code](https://claude.com/claude-code)

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

- **Documentation**
- Added guidance for experimental overlapping PKCE authentication flows,
including separating concurrent flows and exchanging their flow IDs.
- Expanded Dart streaming documentation with filter operators,
multiple-filter behavior, update semantics, delete payloads, and
chained-filter examples.
- Added Swift documentation for admin link generation, user sign-out,
and configurable Edge Function timeouts.
- Documented the default 150-second Edge Function idle timeout and
per-invocation timeout overrides.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>

apps/docs/content/guides/auth/sessions/pkce-flow.mdx

@@ -85,6 +85,42 @@ Behind the scenes, the code exchange requires a code verifier. Both the code in
 
 The code verifier is created and stored locally when the Auth flow is first initiated. That means the code exchange must be initiated on the same browser and device where the flow was started.
 
+## Overlapping flows
+
+If more than one PKCE flow is started on the same browser before either one completes (for example, `signInWithOAuth()` called in two tabs), the code verifier stored for the earlier flow is overwritten by the later one, and exchanging the first flow's code fails.
+
+<Admonition type="caution" title="Experimental">
+
+Support for overlapping flows is currently experimental and requires explicit opt-in as the API may change without notice.
+
+</Admonition>
+
+To keep each flow's verifier separate, set the `appendPkceFlowIdToRedirects` option when creating the client:
+
+```js
+const supabase = createClient(supabaseUrl, supabaseKey, {
+  auth: {
+    experimental: { appendPkceFlowIdToRedirects: true },
+  },
+})
+```
+
+With this enabled, the client library appends a `sb_flow_id` query parameter to `redirectTo`, so your OAuth callback page can read it back and use it to select the matching verifier. You can also get the flow ID directly from the response of `signInWithOAuth()`:
+
+```js
+const { data, error } = await supabase.auth.signInWithOAuth({
+  provider: 'github',
+})
+
+const flowId = data.flowId
+```
+
+Pass the flow ID to `exchangeCodeForSession()` to make sure the correct verifier is used, whether you read it from `data.flowId` or from the `sb_flow_id` query parameter in the redirect URL:
+
+```js
+const { data, error } = await supabase.auth.exchangeCodeForSession(authCode, { flowId })
+```
+
 ## Resources
 
 - [OAuth 2.0 guide](https://oauth.net/2/pkce/) to PKCE flow