Sign in to the hub with its Better Auth device flow; session token as bearer

Co-Authored-By: Claude Opus 5.5 <[email protected]>

README.md

@@ -56,10 +56,12 @@ leaves the machine.
 
 ## The hub
 
-`t5de-proxy signin [-hub URL]` signs the proxy in to T5DE's hub (git.t5de.dev/t5de/t5de-hub): it shows a code to
-enter on the hub's website (`/device`) and saves the sign-in in `%APPDATA%\T5DE\proxy\hub.json`, the refresh
-token encrypted for the Windows user (DPAPI). From then on the running proxy keeps a WebSocket to the hub
-(`internal/hub`), reporting which IMVU account the client signed in as and the community products it wears.
+`t5de-proxy signin [-hub URL]` signs the proxy in to T5DE's hub (git.t5de.dev/t5de/t5de-hub; URL is the hub's
+API): it shows a code to enter on the hub's website (`/device`, OAuth 2.0 device authorization) and saves the
+session token it gets in `%APPDATA%\T5DE\proxy\hub.json`, encrypted for the Windows user (DPAPI). From then on the
+running proxy keeps a WebSocket to the hub (`internal/hub`) with the token as a bearer token, reporting which IMVU
+account the client signed in as and the community products it wears. If the hub ends the session (signed out
+everywhere, banned), the proxy stops connecting until `signin` is run again.
 
 ## Building