docs: fix 329 Microsoft.Contractions hits with proper safety checks

Apply contraction fixes across ~40 doc files (setup, integrations, lifecycle,
networking, scheduler, swarm, tools, trust-boundary, UI, etc.). Skipped 14 hits:
- 10 where words appear in ALL CAPS for deliberate emphasis (is NOT, do NOT, etc.)
- 4 where text could not be safely located due to markdown formatting or column position

Applied via systematic scan with checks for fenced code blocks, inline code spans,
and intentional caps. Preserves sentence-initial capitalization throughout.

docs/swarm/sso.md

@@ -1,6 +1,6 @@
 # Swarm SSO
 
-The swarm runs one authelia, and it is two things at once: the **session
+The swarm runs one authelia, and it's two things at once: the **session
 provider** every protected vhost checks (`auth_request`), and — once any
 client is declared — an **OIDC provider** issuing tokens to relying
 parties: the forge and the matrix homeserver.
@@ -18,7 +18,7 @@ name all follow `deploy.authelia`, so there is nothing to turn on
 separately. (Details, including why a client hive must not declare that
 vhost: [`../networking/gateway.md`](../networking/gateway.md).)
 
-**Authelia does not start until at least one user exists.** The user
+**Authelia doesn't start until at least one user exists.** The user
 store is generated empty — deliberately, since seeding a default account
 would put a credential in a config file — but authelia validates it at
 startup and treats "no users" as fatal:
@@ -31,7 +31,7 @@ error reading the authentication database: could not validate the schema:
 It then exits 1 and systemd restarts it, so a swarm that has been
 enabled but not bootstrapped shows a **crash-looping unit** and `502 Bad
 Gateway` from the vhost — not a login page with nobody able to use it.
-The gateway is working in that state; the upstream is not up.
+The gateway is working in that state; the upstream isn't up.
 
 ⚠️ So the step below is **required to finish the install**, not an
 optional first-login convenience. Run it before concluding anything is
@@ -48,14 +48,14 @@ this password is stored nowhere — record it now
 ```
 
 The password is generated, hashed, and printed once; only the hash is
-kept. `swarmctl` reads and writes authelia's `users.yml` directly — it is
+kept. `swarmctl` reads and writes authelia's `users.yml` directly — it's
 the one user store, shared with `swarm-authelia-bridge`, which creates
 agent identities in the same file. No restart: authelia watches it. Full
 reference: [`../tools/swarmctl-cli.md`](../tools/swarmctl-cli.md).
 
 You can edit `users.yml` by hand, and `swarmctl` will read what you
 wrote. ⚠️ It rewrites the whole file on every change, so **comments and
-formatting do not survive**; values and unrecognised keys do.
+formatting don't survive**; values and unrecognised keys do.
 
 This step stays manual on purpose. Bootstrapping an identity provider
 non-interactively means a secret arriving from somewhere — a file, an
@@ -78,12 +78,12 @@ mara is now in groups: admins
 
 Two behaviours worth knowing before you rely on them:
 
-- **`--remove-group` fails if the user is not in that group.** Every
-  other flag is idempotent — setting what is already set is fine, so a
-  "make these four things true" call does not break when one of them
+- **`--remove-group` fails if the user isn't in that group.** Every
+  other flag is idempotent — setting what's already set is fine, so a
+  "make these four things true" call doesn't break when one of them
   already was. Revocation is the exception on purpose: a typo'd group
   name that reported success would leave an account holding access you
-  believe you took away, and that is the one outcome nobody re-checks.
+  believe you took away, and that's the one outcome nobody re-checks.
 - **The resulting group list is printed** because group names have no
   registry anywhere. A misspelled `--add-group` creates a real group that
   no access-control rule mentions, so the user gains nothing and no error
@@ -105,7 +105,7 @@ the delivery step below and the rest of authelia's keys don't.
 
 ## Getting the plaintext to the relying party
 
-Three cases, and they are genuinely different mechanisms rather than one
+Three cases, and they're genuinely different mechanisms rather than one
 mechanism with flags.
 
 ### 1. All-local — one host runs both
@@ -116,12 +116,12 @@ service's container, and the service's own module contributes its client
 entry — callback URL included — to authelia's client list.
 
 The callback is built once and read twice, so the redirect URI authelia is
-told to allow and the one the service actually sends cannot drift apart. A
+told to allow and the one the service actually sends can't drift apart. A
 mismatch there is a rejected login with no error text worth reading.
 
 ⚠️ The delivery is a copy, not a `bindMounts` entry, and deliberately so:
 nixos-container refuses to start a container whose bind source is
-missing, and this secret does not exist until authelia's first boot has
+missing, and this secret doesn't exist until authelia's first boot has
 run. Binding it would make the service wait on a file that waits on a
 container that starts after it — on a fresh hive, a permanent stall
 presenting as "the forge is broken", several layers from its cause.
@@ -155,7 +155,7 @@ evaluation error.
 ## Where each relying party differs
 
 The registration half is identical; what each service does with the
-result is not.
+result isn't.
 
 |                           | forge                                                                              | matrix                                                                                                           |
 | ------------------------- | ---------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------- |
@@ -175,7 +175,7 @@ Two consequences worth stating plainly:
   spoken by non-browser clients holding matrix access tokens — every
   agent's own daemon — as well as by federation, so `/_matrix/` is served
   directly and authenticates itself. The forward-auth vhosts protect
-  browser surfaces; this is not one of them.
+  browser surfaces; this isn't one of them.
 
 ## Machine clients
 
@@ -198,7 +198,7 @@ valid token refused at the target, which reads like a broken credential
 rather than a broken name.
 
 **Tokens are signed (`RS256`), not opaque**, because a resource server
-that cannot call the provider back is a real case here: the telemetry
+that can't call the provider back is a real case here: the telemetry
 collector verifies offline against `/jwks.json`, and an opaque token gives
 it nothing to verify. The queue's responder introspects instead — a
 different question asked of the same token, and the reason both
@@ -240,13 +240,13 @@ All three matter. A change that silently deleted the browser page would
 pass a deny-only check, and one that quietly stopped denying would pass a
 page-only check. This was verified that way when the split was introduced.
 
-## What this does not do
+## What this doesn't do
 
-- **It does not disable local login.** Each service keeps its password
+- **It doesn't disable local login.** Each service keeps its password
   database and gains a second door. An identity provider that can take a
   service offline when it hiccups is worse than one with two ways in.
   Making authelia the only path is a separate, reversible switch per
   service (tuwunel's `login_with_password`, forgejo's own setting).
-- **It does not provision users.** Agents are created and destroyed
+- **It doesn't provision users.** Agents are created and destroyed
   continuously, so the subject set belongs to a program rather than to a
   config file; today that program is `swarmctl`.