fixing a few thing

README.md

@@ -59,11 +59,11 @@ docker compose exec api php bin/seed
 open http://localhost:8080
 ```
 
-The first user to log in via Jakach Auth is automatically added as admin.
+Set `ALLOW_FIRST_USER_BOOTSTRAP=true` only during initial setup if you want the first Jakach Auth user to be automatically added as admin.
 
 ## Authentication
 
-Uses [Jakach Login](https://github.com/jakani24/jakach-login) for authentication. Users authenticate via `auth.jakach.ch`. The first user is automatically authorized; subsequent users must have their `user_token` added in Settings > Security.
+Uses [Jakach Login](https://github.com/jakani24/jakach-login) for authentication. Users authenticate via `auth.jakach.ch`. Authorized users must have their `user_token` added in Settings > Security. First-user auto-authorization is disabled unless `ALLOW_FIRST_USER_BOOTSTRAP=true` is set for initial setup.
 
 ## Log Sources (Ingestion)
 
@@ -97,11 +97,7 @@ services:
 ```
 
 ### HTTP POST
-```bash
-curl -X POST http://localhost:8080/ingest \
-  -H 'Content-Type: application/json' \
-  -d '{"line":"2024-01-01 ERROR: something broke","source":"my-app"}'
-```
+`/ingest` requires an authenticated session and CSRF token. For unauthenticated service-to-service ingestion, put it behind a trusted reverse proxy or add a dedicated ingest-token flow before exposing it publicly.
 
 ### Shared volume
 ```yaml
@@ -164,7 +160,7 @@ Quick actions in the table: ✓ (acknowledge), ✓✓ (resolve). Click any row f
 | Method | Path | Auth | Description |
 |--------|------|------|-------------|
 | GET | `/health` | No | Health check |
-| POST | `/ingest` | No | Ingest a log line |
+| POST | `/ingest` | Yes | Ingest a log line |
 | GET | `/auth/me` | No | Current session user |
 | POST | `/auth/logout` | No | Destroy session |
 | GET | `/sources` | Yes | List sources |
@@ -242,4 +238,4 @@ composer serve
         ├── FileWatcher.php
         ├── Orchestrator.php
         └── SocketListener.php
-```
+```