Remove internal notification caller tokens

docs/auth-notifications.md

@@ -16,23 +16,21 @@ changes under a new revision rather than mutating deployed content.
 Configure `api.notifications` in the product YAML:
 
 - `address`: internal notifications gRPC address.
-- `token_env`: environment variable containing the configured caller's token
-  (at least 32 bytes); example `SXCHNGE_NOTIFICATIONS_TOKEN`.
-- `ca_file`: trusted PEM CA bundle; omit to use system roots.
+- `ca_file`: optional trusted PEM CA bundle for explicit TLS. Omit both TLS settings for plaintext.
 - `server_name`: optional TLS certificate hostname override, never a TLS bypass.
 - `activation_url`: absolute frontend `/verify-email` URL. HTTPS is required,
   except HTTP on localhost/127.0.0.1 for development. No user-supplied redirect is
   accepted. The token is appended as a query parameter.
 
-The caller token must map to the product caller in the notification service's
-configuration. Keep Mongo, notification caller, TLS and provider credentials out
+The private notifications endpoint uses the existing product storage namespace
+without caller authentication. Keep Mongo, TLS and provider credentials out
 of Git. JWT signing configuration must contain at least 32 bytes of private key
 material; HMAC-derived issuance keys depend on this key. Rotation changes replay
 keys and existing pending JWT validity. Omission of `api.notifications` preserves
 the bootstrap-only legacy routes; it does not enable signup or code completion.
-The example config enables the integration and therefore requires credentials.
+The example config enables the integration; configure Mongo, NATS and email credentials separately.
 
-The notification service must be reachable over TLS, with its Mongo/NATS/email
+The notification service must be reachable on the private network, with its Mongo/NATS/email
 provider configured. Product startup creates a lazy gRPC channel; dependency
 outages appear as HTTP 503 when attempting delivery. A successful Send means
 persisted queue acceptance, not inbox delivery or a provider receipt.