docs: update README for OAuth2 PKCE auth, remove username/password

Replace the Minimed CareLink setup docs with the new OAuth2 flow:
- Remove CONNECT_CARELINK_USERNAME/PASSWORD from setup instructions
- Document the nightscout-connect login command and DevTools paste flow
- Add MONGO_CONNECTION requirement
- Mention upcoming Nightscout admin UI integration

Author: LeFrenchGuy

README.md

@@ -116,10 +116,8 @@ Where `subject.env` typically consists of something like this:
 CONNECT_API_SECRET=626753d7f62f000078e8f6e2
 CONNECT_NIGHTSCOUT_ENDPOINT=http://localhost:3030
 CONNECT_SOURCE=minimedcarelink
-CONNECT_CARELINK_USERNAME=your username
-CONNECT_CARELINK_PASSWORD=your password
-CONNECT_CARELINK_REGION=your region
-CONNECT_COUNTRY_CODE=your country code
+CONNECT_CARELINK_REGION=eu
+MONGO_CONNECTION=mongodb://localhost:27017/nightscout
 ```
 
 
@@ -196,16 +194,43 @@ the `CONNECT_LINK_UP_PATIENT_ID` variable.
 
 ### Minimed Carelink
 
-To synchronize from Medtronic Minimed Carelink, set the following
-environment variables.
+Medtronic CareLink now uses an OAuth2 PKCE flow — username and password authentication is no longer supported. Authentication requires a one-time login step to obtain OAuth tokens, which are then stored in MongoDB and refreshed automatically.
+
+#### Setup
+
+**Required environment variables:**
 * `CONNECT_SOURCE=minimedcarelink`
-* `CONNECT_CARELINK_USERNAME`
-* `CONNECT_CARELINK_PASSWORD`
-* `CONNECT_CARELINK_REGION` Either `eu` to set `CONNECT_CARELINK_SERVER` to
-  `carelink.minimed.eu` or `us` to use `carelink.minimed.com`.
+* `MONGO_CONNECTION` — your MongoDB URI (same as Nightscout's `MONGO_CONNECTION`, no duplication needed)
+* `CONNECT_CARELINK_REGION` — `eu` (default) or `us`
+
+`CONNECT_CARELINK_USERNAME` and `CONNECT_CARELINK_PASSWORD` are no longer used and can be removed from your config.
+
+#### One-time login
+
+Before starting the poller for the first time, run:
+
+```bash
+nightscout-connect login             # EU by default
+nightscout-connect login --region us
+```
+
+This will open the CareLink login page in your browser. After logging in:
+
+1. The page will **fail to load** — this is expected. CareLink redirects to a custom app scheme (`com.medtronic.carepartner://`) that the browser cannot handle
+2. Open DevTools (`F12`) → Network tab → find the blocked request to `/authorize/resume`
+3. Click it → Response Headers → copy the `Location` value (starts with `com.medtronic.carepartner:/sso?code=...`)
+4. Paste it back into the terminal when prompted
+
+Tokens are saved to MongoDB and the poller can now start. Token refresh is handled automatically — you only need to re-run `login` if the refresh token expires (~30 days).
+
+#### Nightscout admin UI (optional)
+
+If you are running [cgm-remote-monitor](https://github.com/nightscout/cgm-remote-monitor), the login flow is also available directly from the Nightscout `/admin` page under **CareLink Authentication** — no CLI access needed.
+
+#### Many to Many
 
-For folks using the new Many to Many feature, please provide the username of the
-patient to follow using `CONNECT_CARELINK_PATIENT_USERNAME` variable.
+For folks using the Many to Many feature, provide the username of the patient to follow:
+* `CONNECT_CARELINK_PATIENT_USERNAME`
 
 ### Tidepool