docs: scope the plaintext-credentials claim to the server (BEA-120) (#176)

"No plaintext credentials ever touch disk" sat in the paragraph about the
server's auth.json, where it is true, and read on its own as a product-wide
promise the client does not keep: the device token lives in plaintext at
~/.bdrive/settings.json.

Say what the server does, then say what the client does — path, 0600 mode, and
that `bdrive logout` revokes it — in the same passage. Both halves check out
against the code (config.go's 0600 for everything under $BDRIVE_HOME,
DELETE /api/auth/token on logout).

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

web/docs/src/content/docs/self-hosting/authentication.md

@@ -9,8 +9,10 @@ whole API (web UI, uploads, project creation, device sync) needs a session; only
 `bdrive serve ./folder`, remains auth-free.
 
 Accounts are email, password, and name, kept in a file-backed registry
-(`auth.json`): bcrypt password hashes and SHA-256 token digests, atomically
-rewritten. No plaintext credentials ever touch disk.
+(`auth.json`), atomically rewritten. No plaintext credentials are stored on the
+server — passwords are bcrypt-hashed and tokens are kept as SHA-256 digests. On
+a client device, the sync token is stored at `~/.bdrive/settings.json` with
+`0600` permissions and can be revoked from that device with `bdrive logout`.
 
 ## Signup is invite-only by default