[P2] Correct README claims that the service needs no database or shared state #58

Recorded during review of main at a1eb305ccfa2f3fc8ddede4875765cf1b099bd2b. This issue records a finding only; no implementation changes were made or requested.

Finding

The introduction describes the service as having no database and requiring no shared state. PostgreSQL is mandatory and stores replay protection, OAuth states, handoffs, and rotating connection credentials. Cookie-based tenant login sessions alone do not make the entire service stateless.

Evidence

• README.md:3
• src/security.rs:1
• src/config.rs:59

Desired outcome

Describe the database-backed service accurately and distinguish cookie-based login sessions from connection state. Make deployment requirements clear.