chore: doc updates

Signed-off-by: Alan Brault <alan.brault@visus.io>

README.md

@@ -22,6 +22,7 @@ A reactive REST API built with **Kotlin**, **Spring Boot WebFlux**, and **MongoD
   - [Run with Docker](#run-with-docker)
 - [API Reference](#-api-reference)
 - [Project Structure](#-project-structure)
+- [Documentation](#-documentation)
 - [Development](#-development)
 
 ---
@@ -86,6 +87,17 @@ openssl rand -base64 32 | tr -d '\n'
 
 The API starts on **http://localhost:8080**.
 
+#### Seed Users
+
+On startup, two users are automatically created if they don't already exist:
+
+| Email | Password | Role |
+|---|---|---|
+| `user@example.com` | `user12345` | `ROLE_USER` |
+| `admin@example.com` | `admin12345` | `ROLE_ADMIN` |
+
+Use these credentials with `POST /v1/auth/login` to get started quickly.
+
 ### Run with Docker
 
 ```bash
@@ -148,6 +160,12 @@ src/main/kotlin/io/visus/demos/kotlinapi/
 
 ---
 
+## 📚 Documentation
+
+- [Authentication & Security](docs/authentication-and-security.md) — JWE tokens, refresh rotation, theft detection, RBAC, and configuration
+
+---
+
 ## 🧑‍💻 Development
 
 ```bash