Clarify TLS proof response binding

[saviro-orin]

Problem

The TLS proof overview claimed the proof establishes that the data Airnode signed came from the upstream API. The gateway performs a separate fetch, so the attested response may legitimately differ from the signed payload.

Changes

• state the separate-fetch boundary at the top of the proof documentation
• describe proofs as narrowing the provenance gap rather than closing it
• preserve the detailed response-binding warning later in the page

Verification

• book production build passed