docs: document per-client token lifetime env vars

Author: sricharan-varanasi

.env.default

@@ -36,6 +36,10 @@ AUTHENTICATION__REFRESH_TOKEN__SECRET_KEY="secret2"
 AUTHENTICATION__MFA_TOKEN__SECRET_KEY="secret3"
 AUTHENTICATION__ACCESS_TOKEN__EXPIRATION=30
 AUTHENTICATION__REFRESH_TOKEN__EXPIRATION=540
+# Optional shorter token lifetimes (minutes) for web/admin clients. Unset = same as the
+# values above (feature off). Mobile and unknown/legacy clients always use the values above.
+#AUTHENTICATION__ACCESS_TOKEN__WEB_ADMIN_EXPIRATION=
+#AUTHENTICATION__REFRESH_TOKEN__WEB_ADMIN_EXPIRATION=
 AUTHENTICATION__ALGORITHM="HS256"
 AUTHENTICATION__TOKEN_TYPE="Bearer"
 AUTHENTICATION__PASSWORD_RECOVER__EXPIRATION=900