docs(readme): add Authentication section

[eric-factory]

What

Adds a dedicated Authentication section to the README (before Configuration).

Why

The README only covered auth briefly inside 'Manual Setup' and a config table, which left users unclear on how the two pieces fit together. The new section explains them up front:

1. Factory API key — the FACTORY_API_KEY secret used to run Droid.
2. GitHub access — posting reviews via the Factory Droid GitHub App (default, needs id-token: write) or a custom github_token override.

Includes a short GitLab note. Companion to the docs.factory.ai code-review guide update.

Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>

[factory-droid]

Droid finished @eric-factory's task —— View job

---

Docs update is clear and helpful. Suggested follow-ups are to clarify least-privilege workflow permissions for GitHub App auth, and to consider pinning Factory-AI/droid-action to a tag or SHA in workflow examples to reduce supply-chain risk.

[factory-droid]

[P1] Clarify required vs recommended workflow permissions in Authentication

The new GitHub App example says it “requires id-token: write” but then shows a broader permissions: block (including contents: write) that also differs from earlier README examples (some use contents: read); clarifying which permissions are truly required for “post reviews” vs which are only needed for branch-writing flows helps users apply least privilege and avoids confusion.

Suggested change

	permissions:
	contents: write
	pull-requests: write
	issues: write
	id-token: write # required for GitHub App auth
	permissions:
	contents: read # use write if you want Droid to push branches (e.g., @droid fill)
	pull-requests: write
	issues: write
	id-token: write # required for GitHub App auth

[factory-droid]

[P1] [security] Pin the action ref instead of using @main

The new examples use Factory-AI/droid-action@main, which is a mutable ref; pinning to an immutable tag or (preferably) a commit SHA in docs reduces supply-chain risk, since a compromised/updated branch would otherwise be executed automatically with your workflow permissions and access to secrets.