docs: document Endorser auth flow and ENDORSER_URL

Describe when register/refresh verify with Endorser, keep the testMode bypass notes, and list ENDORSER_URL in the env table.

README.md

@@ -6,9 +6,11 @@ A lightweight Express service that schedules and sends Firebase Cloud Messaging
 cp .env.example .env
 ```
 
-Edit .env — set FIREBASE_SERVICE_ACCOUNT_JSON
+Edit .env — set `FIREBASE_SERVICE_ACCOUNT_JSON`.
 Here is one way to generate the contents: `cat your-downloaded-key.json | jq -c .`
 
+Optionally set `ENDORSER_URL` if you are not using the default production Endorser API (`https://api.endorser.ch`).
+
 ```bash
 pnpm install
 pnpm run dev
@@ -16,7 +18,13 @@ pnpm run dev
 
 The server starts on `http://localhost:3003` (or the port in `PORT`). Hot-reloads on file changes.
 
-Set `NODE_ENV=test-local` in `.env` to bypass JWT expiry verification during local development.
+### Authentication
+
+`POST /notifications/register` and `POST /notifications/refresh` require a Bearer JWT. After local JWT verification, the service checks the token with Endorser (`GET /api/report/rateLimits` on `ENDORSER_URL`). Registration and refresh continue only if Endorser accepts the JWT.
+
+**Local notification test bypass:** send `testMode: true` in the JSON body and omit the `Authorization` header. The request skips JWT and Endorser checks and uses a synthetic local test user, same as before.
+
+Set `NODE_ENV=test-local` in `.env` to bypass ethr JWT *expiry* verification during local development (this is separate from the `testMode` bypass above).
 
 ## Production
 
@@ -40,4 +48,5 @@ Required environment variables:
 |---|---|
 | `FIREBASE_SERVICE_ACCOUNT_JSON` | Inline service account JSON (one line). If unset, falls back to Application Default Credentials. |
 | `PORT` | HTTP port (default: `3003`). |
+| `ENDORSER_URL` | Endorser API base URL used for auth checks on register/refresh (default: `https://api.endorser.ch`). |
 | `FCM_TOKEN_DATA_DIR` | Directory for persisting registered FCM tokens (default: `./data`). |