docs(roles): condense roles/permissions/auth docs and align with the code

docs/oidc-account-linking.md

@@ -102,12 +102,12 @@ Interactive UI for password verification and account linking.
 
 **Changes**:
 
-- `lib/mv_web/locale_controller.ex`: Sets locale cookie with `http_only` and `secure` flags
+- `MvWeb.LocaleController`: Sets locale cookie with `http_only` and a config-driven `secure` flag
 - `lib/mv_web/router.ex`: Reads locale from cookie if session empty
 
 **Security Features**:
 - `http_only: true` - Cookie not accessible via JavaScript (XSS protection)
-- `secure: true` - Cookie only transmitted over HTTPS in production
+- `secure: Application.get_env(:mv, :use_secure_cookies, false)` - the `secure` flag is config-driven (defaults to `false`; enabled in production) so the cookie is only transmitted over HTTPS in production
 - `same_site: "Lax"` - CSRF protection
 
 ## Security Considerations
@@ -139,47 +139,6 @@ Interactive UI for password verification and account linking.
   - `Logger.warning` for failed authentication attempts
   - `Logger.error` for system errors
 
-## Usage Examples
-
-### Scenario 1: New OIDC User
-
-```elixir
-# User signs in with OIDC for the first time
-# → New user created with oidc_id
-```
-
-### Scenario 2: Existing OIDC User
-
-```elixir
-# User with oidc_id signs in via OIDC
-# → Matched by oidc_id, email updated if changed
-```
-
-### Scenario 3: Password User + OIDC Login
-
-```elixir
-# User with password account tries OIDC login
-# → PasswordVerificationRequired raised
-# → Redirected to /auth/link-oidc-account
-# → User enters password
-# → Password verified and logged
-# → oidc_id linked to account
-# → Successful linking logged
-# → Redirected to complete OIDC login
-```
-
-### Scenario 4: Passwordless User + OIDC Login
-
-```elixir
-# User without password (invited user) tries OIDC login
-# → PasswordVerificationRequired raised
-# → Redirected to /auth/link-oidc-account
-# → System detects passwordless user
-# → oidc_id automatically linked (no password prompt)
-# → Auto-linking logged
-# → Redirected to complete OIDC login
-```
-
 ## API
 
 ### Custom Actions