README: fix copy-paste traps and inconsistent placeholders

Issues found in audit:
1. Three curl examples in 'Commands' section used the literal word
   'Bearer TOKEN' which would return 401 on copy-paste. Replaced with
   'Bearer <your-token-here>' and added a note explaining the dual
   auth model (legacy TOKEN for routers, JWT for dashboard).
2. Manual dev Quick Start had JWT_SECRET=replace-me, which would
   fall through to the insecure dev key. Fixed to use the
   'openssl rand -hex 32' subshell like the docker-compose example.
3. Normalised all TOKEN placeholders to 'replace-me' style (had a mix
   of 'replace-me', 'replace-with-shared-secret',
   'replace-with-router-shared-secret', and 'replace-with-32+bytes').
4. Reworded subtitle: 'Lightweight' understated the scope. Now:
   'OpenWrt event forwarder with a real-time web dashboard,
    command queue, and persistent history.'
5. Added comment to JWT_SECRET line clarifying it must be 32+ random
   bytes in production (not just 'some string').

No code or behavioural changes - documentation only.

README.md

@@ -4,7 +4,7 @@
 
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
 
-Lightweight OpenWrt event forwarder with a real-time web dashboard.
+OpenWrt event forwarder with a real-time web dashboard, command queue, and persistent history.
 Routers stream DHCP, WiFi, and WAN events over WebSocket; the Go server
 fans them out to Redpanda and persists them to SQLite; a React/TypeScript
 SPA gives you live visibility and command control from any browser.
@@ -87,7 +87,7 @@ cd client2server
 
 # Set secrets (use any 32+ byte strings)
 cat > .env <<EOF
-TOKEN=replace-with-router-shared-secret
+TOKEN=replace-me
 JWT_SECRET=$(openssl rand -hex 32)
 EOF
 
@@ -110,7 +110,7 @@ cd server
 go build -o server .
 REDPANDA_BROKERS=localhost:9092 \
   TOKEN=replace-me \
-  JWT_SECRET=replace-me \
+  JWT_SECRET=$(openssl rand -hex 32) \
   PORT=3843 \
   ./server
 
@@ -144,8 +144,8 @@ ssh root@router "/etc/init.d/client2server enable && /etc/init.d/client2server s
 ### Environment Variables
 
 ```bash
-TOKEN=replace-with-shared-secret      # Legacy router/hotplug shared token
-JWT_SECRET=replace-with-32+bytes     # JWT signing key for dashboard auth
+TOKEN=replace-me                    # Legacy router/hotplug shared token
+JWT_SECRET=replace-me-32+bytes       # JWT signing key for dashboard auth (32+ random bytes)
 REDPANDA_BROKERS=redpanda:9092        # Comma-separated Redpanda addresses
 PORT=3843                            # Server listen port
 DB_PATH=/var/lib/c2s/client2server.db # SQLite path
@@ -194,20 +194,24 @@ Send from server to router via WebSocket or HTTP API:
 ```bash
 # Reboot
 curl -X POST http://localhost:3843/api/command \
-  -H "Authorization: Bearer TOKEN" \
+  -H "Authorization: Bearer <your-token-here>" \
   -d '{"router_id":"router1","command":"reboot"}'
 
 # UCI set
 curl -X POST http://localhost:3843/api/command \
-  -H "Authorization: Bearer TOKEN" \
+  -H "Authorization: Bearer <your-token-here>" \
   -d '{"router_id":"router1","command":"uci_set","args":{"config":"network","section":"lan","option":"ipaddr","value":"192.168.1.1"}}'
 
 # Shell
 curl -X POST http://localhost:3843/api/command \
-  -H "Authorization: Bearer TOKEN" \
+  -H "Authorization: Bearer <your-token-here>" \
   -d '{"router_id":"router1","command":"shell","args":{"command":"uptime"}}'
 ```
 
+The token can be either the legacy `TOKEN` shared secret (used by routers and
+hotplug scripts) or a JWT obtained from `POST /api/auth/login` (used by the
+dashboard). The router doesn't need a JWT — it sends the shared `TOKEN` directly.
+
 ### Available Commands
 
 | Command | Description | Arguments | Dangerous |