fix: alot

docs/security.md

@@ -11,15 +11,16 @@
 
 ### Client Authentication
 - Passwords hashed with bcrypt (10 rounds)
-- JWT access tokens (24h expiration)
-- Refresh tokens with rotation and revocation
-- Tokens stored in HttpOnly cookies on dashboard
+- JWT access tokens (15 minute expiration)
+- Refresh tokens (30 days) with rotation and revocation; a refresh token works only once
+- The dashboard keeps both tokens in `SameSite=Lax` cookies (`Secure` over HTTPS). They are readable by
+  the dashboard's JavaScript, so an XSS bug would expose them; the short access token lifetime limits the damage
 
 ## Authorization
 
 ### Role-Based Access
-- `admin`: Full access including device management and revocation
-- `viewer`: Read-only access to tabs, devices, and commands
+- `admin`: Full access, including users, device pairing, planned customers and sending reminders
+- `viewer` (shown as staff): views tabs and commands and can close tabs
 
 ### Venue Isolation
 - Every user and device is scoped to exactly one venue
@@ -34,9 +35,9 @@
 - Body size limits enforced
 
 ### Rate Limiting
-- Device sync: 1 request per 30 seconds per device
-- Command creation: 10 requests per minute per user
+- Login and device registration: 10 requests per minute per client
 - General: 100 requests per minute per client
+- Device sync and command acks are not rate limited (they are authenticated by the device token)
 
 ### Error Handling
 - Consistent error format never exposes internals