Handle encrypted/HS256 id_tokens and let an admin claim promote on login

README.md

@@ -103,8 +103,11 @@ own `/docs` / `/openapi.json` requires a session: unauthenticated requests get
 | `admin` | everything a viewer can, plus create/update/delete services and list or change user roles |
 | `viewer` | read the service list, open services through the proxy, see their own profile |
 
-The role is decided at **first** login and never changed by logging in again -
-promotions and demotions go through `PATCH /api/users/{id}` (or the Settings page):
+The role is recomputed on **every** login, but a login only ever promotes: a
+matching `UWUDASH_OIDC_ADMIN_CLAIM` turns an existing `viewer` into `admin`,
+while an existing `admin` is never demoted by a login - demotions go through
+`PATCH /api/users/{id}` (or the Settings page), so a misconfigured claim
+cannot lock the dashboard out:
 
 1. if `UWUDASH_OIDC_ADMIN_CLAIM` is set and the token's claim (scalar or list)
    contains one of `UWUDASH_OIDC_ADMIN_VALUES` → `admin`;