docs(auth): document token authentication flow

documentation/backend/services/auth.md

@@ -249,6 +249,13 @@ oidc.admin_claim_value       = 'readmeabook-admin'
 - **Admin Settings:** OIDC section in `/admin/settings` (auth tab)
 - **Library:** `openid-client` (OIDC discovery, token exchange, PKCE)
 
+## Admin-Generated Login Token
+
+- Login token stored as SHA-256 hash in `User.loginTokenHash`
+- Admin generates/revokes via user permissions modal
+- User login with token `/auth/token/login?token=rmab_...`
+- Invalid token redirects to `/login`
+
 ## Security
 
 - Never log tokens