Add Protect section: Wireless, Wired, and SSH for GitHub use-case guides

[joshdrake]

What this does

Adds a new Protect section to the Platform nav with three self-contained, API-first use-case guides, each following the same outline — configure credential issuance (API) → configure the enforcement point → configure clients (agent- or MDM-managed):

• tutorials/protect-wireless-networks.mdx — 802.1X EAP-TLS Wi-Fi
• tutorials/protect-wired-networks.mdx — 802.1X EAP-TLS ethernet (new coverage; nothing existed)
• tutorials/protect-github-ssh.mdx — hardware-bound SSH certificates for GitHub Enterprise

Removed pages (content absorbed into the Wireless guide)

• tutorials/wifi-setup-guide.mdx (AP vendor reference)
• tutorials/intune-mdm-setup-guide.mdx (Intune SCEP + Wi-Fi template)
• tutorials/apple-mdm-jamf-setup-guide.mdx (Jamf SCEP webhook flow)
• tutorials/wifi-authentication-webhooks.mdx (Enterprise RADIUS webhook spec)

Redirects for the four retired URLs: smallstep/smallstep.com PR https://github.com/smallstep/smallstep.com/pull/1193 (merge that one first or together to avoid 404s).

Notes for reviewers

API examples target v2025-01-01 and were audited against the OpenAPI spec. Two flow details differ from older internal drafts:

1. The RADIUS shared secret is not returned by POST /managed-radius; the guides retrieve it via GET /managed-radius/{id}?secret=true.
2. certificate.authorityID is required on POST /credentials, so the guides start with GET /authorities (which also supplies the clientCA root for managed RADIUS).

Please confirm before merge (ideally with a live smoke test on a test team):

• GET /managed-radius/{id}?secret=true is the correct way to obtain the shared secret
• Which authority should be recommended for Wi-Fi client credentials and for SSH_USER credentials (guides currently say "choose the authority")
• Windows agent native wired 802.1X is GA (the wired guide documents it as supported)
• Enterprise RADIUS details (RadSec, per-region static IPs, reply attributes) are approved for public docs
• The Jamf .mobileconfig template + SCEP webhook settings are exposed on the Wi-Fi resource page as described (UI affordances were re-framed from the old device-collection flow)
• Okta SCIM githubUsername attribute steps match a live tenant

Follow-ups noted for later: VPN section migration under Protect, switch-vendor wired guide, macOS wired MDM payload, Google Workspace/Entra ID GitHub-username attribute docs.

🤖 Generated with Claude Code

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}