docs: add instance administrator hardening guide (#12678)

# Which Problems Are Solved

- Operators lack a single guide for separating instance-level principals
(break-glass, login client) from tenant organizations.
- Login policy and IdP behavior for platform accounts is easy to
conflate with customer org settings when admins share one organization.
- There is no documented procedure to inventory instance administrators
or detect unexpected grants over time.

# How the Problems Are Solved

- Add Hardening instance administrators covering:
- Dedicated platform organization layout and why login, password, and
lockout policies matter for operator accounts.
- Login client (`IAM_LOGIN_CLIENT`) and break-glass (`IAM_OWNER`)
hygiene.
- Periodic review with Internal Permission Service v2
`ListAdministrators` (instance and platform org filters).
- Actions v2 webhooks for `instance.member.*` and `org.member.*` events
(with payload interpretation and alert hints).
- Event API polling alternative for SIEM/batch pipelines
(`instance.member.*` and platform-org `org.member.*`).
- Register the page in the docs sidebar under Roles & Permissions.
- Cross-link from administrators, production checklists, login-client
setup, and service account authentication guides.

# Additional Changes

- Clarify instance vs org IdP availability depends on effective login
policy and linked providers (not automatic for all orgs).
- Note deprecated Admin API `POST /admin/v1/members/_search` vs v2
`ListAdministrators`.

# Additional Context

- Operational hardening guide only (no product authz changes).

---------

Co-authored-by: Cursor <[email protected]>

apps/docs/content/guides/integrate/service-accounts/authenticate-service-accounts.mdx

@@ -30,6 +30,7 @@ Unlike users, service accounts don't rely on traditional login methods (e.g., us
 ### Segregated authorization
 
 Manage authorization for service accounts separately from human users, providing an extra layer of control.
+For service accounts with instance-level permissions (login client, break-glass owner), use a [dedicated organization for instance administrators](/guides/manage/console/administrator-hardening). Organization permissions and login settings for application organizations must not overlap with instance administrators.
 
 ### API and backend access