update

docs/deployment.md

@@ -53,7 +53,9 @@ Create these separately:
 
 The OAuth client secret authenticates the portal to Gitea. The package token
 is used only server-side while proxying an authorized file. Neither value is
-returned to a technician or Proxmox host.
+returned to a technician or Proxmox host. The broker requests only Gitea's
+`read:user` OAuth scope, which it uses to confirm the signed-in username
+against `TAPM_ALLOWED_GITEA_USERS`.
 
 ## 4. Broker configuration