readme update

README.md

@@ -126,11 +126,11 @@ Callbacks now authenticates to Vault through a sidecar Vault Agent (AppRole), sa
 Required Vault policy (minimal read-only for KV v2 mount `kv`):
 
 ```hcl
-path "kv/data/callbacks/*" {
+path "kv/data/sendico/callbacks/*" {
   capabilities = ["read"]
 }
 
-path "kv/metadata/callbacks/*" {
+path "kv/metadata/sendico/callbacks/*" {
   capabilities = ["read", "list"]
 }
 ```
@@ -158,5 +158,5 @@ vault kv put kv/sendico/edge/callbacks/vault \
 Store webhook signing secrets (example path consumed by `secret_ref`):
 
 ```bash
-vault kv put kv/callbacks/client-a/webhook secret="super-secret"
+vault kv put kv/sendico/callbacks/client-a/webhook secret="super-secret"
 ```