Created WebUI Authentication Token Expiration (markdown)

WebUI-Authentication-Token-Expiration.md

@@ -0,0 +1,18 @@
+Bichon maintains **two types of tokens per user**, each serving a different purpose.
+
+### 1. WebUI Token
+- A **single, internal token** per user
+- **Not visible** to the user
+- **Generated on each login**
+- Stored in **`localStorage`**
+- Expiration is enforced **server-side**
+- Controlled by `bichon_webui_token_expiration_hours`
+  - Default: **168 hours (7 days)**
+- Closing the browser does **not** log the user out
+- The user remains logged in until the token expires or they explicitly log out
+
+### 2. API Tokens
+- **User-managed** tokens
+- Users can create **multiple API tokens**
+- **No hard limit** on the number of API tokens
+- Intended for programmatic access (API usage), including **`bichonctl`**