docs: expand security notes

[leno23]

Summary

• expand the README security notes with JWT identity handling and protected-route scope
• add secret hygiene guidance for .env, JWT_SECRET, DATABASE_URL, and provider credentials
• document rotation steps when secrets are exposed

Closes #17.

Checks

• git diff --check
• README security notes assertion against auth middleware/controller and wallet service

[vercel]

@leno23 is attempting to deploy a commit to the loadedvessel2-6186's projects Team on Vercel.

A member of the Team first needs to authorize it.