docs: add documentation regarding the safety of query-string token usage

src/ReverseLlama.Server/TokenAuthentication.cs

@@ -47,6 +47,9 @@ internal static class TokenAuthentication
             }
         }
 
+        // Path-token auth: useful for clients that cannot send headers.
+        // SECURITY: the token appears in the URL and will be logged by
+        // web servers, proxies, and browsers. Prefer header auth when possible.
         if (allowPathToken
             && TryGetPathToken(request.Path, out var pathToken, out _))
         {
@@ -57,6 +60,9 @@ internal static class TokenAuthentication
             }
         }
 
+        // Query-string auth: needed for clients that cannot send headers
+        // (e.g. browser address bar, status page).
+        // SECURITY: same URL-logging risks as path-token auth above.
         if (allowQueryToken
             && request.Query.TryGetValue("token", out var queryValues))
         {