feat: dashboard token auth + README v2/v3 payload sections split

Dashboard:
- Optional DASHBOARD_TOKEN env var (K8s secret 'snek-dashboard-secret')
- Flask before_request check via Authorization header or ?token= param
- /webhook and /healthz remain public (SNEK POST needs to reach webhook)
- Frontend prompts for token on first load, stores in localStorage
- Token forwarded on fetch() calls and EventSource URL

README decoding section:
- Split into two full sub-sections for Sens'it Discovery (v3) and Sens'it v2
- Explicit bit ordering note (MSB-LSB v3 vs LSB-MSB v2)
- Byte-by-byte tables, formulas per mode, worked examples
- Note that auto-detection uses byte 0 bits 2-0 == 0b110 marker for v3

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

dashboard/app.py

@@ -15,8 +15,24 @@ from sensit_decoder import decode as sensit_decode
 DB_PATH = os.environ.get("DB_PATH", "/data/messages.db")
 Path(DB_PATH).parent.mkdir(parents=True, exist_ok=True)
 
+TOKEN = os.environ.get("DASHBOARD_TOKEN", "").strip()
+PUBLIC_ROUTES = {"/webhook", "/healthz"}
+
 app = Flask(__name__, static_folder="static", static_url_path="/static")
 
+
+@app.before_request
+def _check_token():
+    if not TOKEN or request.path in PUBLIC_ROUTES:
+        return None
+    supplied = (
+        request.headers.get("Authorization", "").removeprefix("Bearer ").strip()
+        or request.args.get("token", "").strip()
+    )
+    if supplied != TOKEN:
+        return jsonify({"error": "unauthorized"}), 401
+    return None
+
 # --- SSE broadcast ---
 _subscribers: list[queue.Queue] = []
 _subscribers_lock = threading.Lock()