docs: document auth token, no-shell app commands, web editor, media keys

Update README for the new security model and features: local API access
token embedded in the URL/QR (and web.allow_lan), app commands executing
without a shell, relay password in OS keyring, web-based macro creation,
and media/system keys.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

README.md

@@ -11,6 +11,7 @@ A cross-platform macro management application with desktop and web interfaces. C
   - **Hotkeys**: Key combinations (Ctrl+C, Alt+Tab, etc.)
   - **Wait**: Insert delays between commands (in milliseconds)
   - **App**: Launch applications or scripts
+- **Media & System Keys**: Control playback and audio (volume up/down/mute, play/pause, next/previous track, stop) alongside regular keys
 - **Custom Images**: Assign images to macros for easy identification
 - **Category Management**: Organize macros into custom tabs
 
@@ -119,15 +120,18 @@ A macro that types a username, waits, presses Tab, types a password, and presses
 ### Web Interface (PWA)
 
 1. Start the application (web server starts automatically on port 40000)
-2. Note the URL shown in the toolbar (e.g., `http://192.168.1.100:40000`)
+2. Note the URL shown in the toolbar (e.g., `http://192.168.1.100:40000/?token=...`)
 3. Open this URL on any device on your network
 4. **Install as PWA**:
    - Mobile: Tap browser menu → "Add to Home Screen"
    - Desktop: Click install icon in address bar
 
+> [!IMPORTANT]
+> The local web server now requires an access token. A per-install token is auto-generated and stored in `settings.json`, and is embedded in the URL shown in the toolbar and in the QR code — so copying the URL or scanning the QR just works. Anyone with that URL can control your macros, so treat it like a password. By default the server also binds to your LAN; set `web.allow_lan` to `false` in settings to restrict access to localhost only.
+
 The web interface provides full macro management:
 - View and execute macros
-- Create and edit macros with command builder
+- Create, edit, and delete macros directly from the web app — tap the **+** button to open the command-sequence builder (no desktop app required)
 - Organize into categories
 - Real-time sync across devices
 
@@ -154,7 +158,10 @@ Once connected, a relay URL will appear in the toolbar. Use this URL from any de
 - Wake lock and fullscreen mode
 
 > [!NOTE]
-> You need access to a relay server. See [MP-Relay](https://repo.anhonesthost.net/MacroPad/MP-Relay) for self-hosting instructions.
+> The relay password is stored in your OS keyring when one is available, falling back to the settings file (written with restricted `0600` permissions) otherwise.
+
+> [!NOTE]
+> You need access to a relay server. See [MP-Relay](https://repo.anhonesthost.net/MacroPad/MP-Relay) for self-hosting instructions. The self-hosted relay now enforces login rate-limiting/lockout, keeps credentials out of URLs, and requires setting sane environment values — see the relay repo's `.env.example`.
 
 ## Command Types Reference
 
@@ -164,10 +171,13 @@ Once connected, a relay URL will appear in the toolbar. Use this URL from any de
 | `key` | Presses a single key | `value`: Key name (enter, tab, escape, f1-f12, etc.) |
 | `hotkey` | Presses key combination | `keys`: List of keys (e.g., ["ctrl", "c"]) |
 | `wait` | Delays execution | `ms`: Milliseconds to wait |
-| `app` | Launches application | `command`: Shell command to execute |
+| `app` | Launches an application | `command`: Program and arguments to run (tokenized and executed directly — no shell) |
 
 ## Example Application Commands
 
+> [!IMPORTANT]
+> `app` commands are tokenized and the program is executed **directly**, without a shell. This closes a remote-code-execution risk, but it means shell features are **not** supported: command chaining (`;`, `&&`, `|`), output redirection (`>`), environment-variable expansion (`$VAR`, `%VAR%`), and shell built-ins will not work. Launching a program with arguments works exactly as shown below.
+
 ### Windows
 ```bash
 # Steam game