ci: raise the coverage gate to 90 percent; docs: reconcile OAuth docs with the implementation

README.md

@@ -126,9 +126,14 @@ Both modes can run on one HTTP deployment at the same time (details in
   calls then run with that user's own Gitea token, so Gitea enforces that user's permissions:
   admin tools fail with Gitea's own 403 for non-admins. Upstream tokens are refreshed
   automatically. Stored user tokens are encrypted (Fernet, key derived from
-  `TOKEN_ENCRYPTION_KEY`) in `DATA_DIR/oauth-tokens.json` with mode 0600; the server's own
-  tokens are stored only as SHA-256 hashes. The signed-in login is visible in the `identity`
-  field of every result.
+  `TOKEN_ENCRYPTION_KEY`) in `DATA_DIR/oauth-store.json` with mode 0600; the server's own
+  tokens are stored only as SHA-256 hashes. A store written with another key stops startup until
+  the key is restored or the file is moved away. The signed-in login is visible in the
+  `identity` field of every result. Before the browser goes to Gitea, a consent page
+  (`/oauth/consent`) names the client and where the result goes and needs an explicit approval;
+  for public deployments set `OAUTH_REDIRECT_ALLOWLIST` to the hosted clients you use. An
+  OAuth-only deployment (no `MCP_BEARER_TOKEN`, no `GITEA_TOKEN`) is supported: it has no admin
+  identity to fall back to.
 
 ## Client configuration