Merge dev to master for release of v2.1.0

backend/Readme.md

@@ -229,3 +229,33 @@ SMTP_PASSWORD=your_app_password
 - **Dev:** use MailHog → safe, no real emails.  
 - **Prod:** use real SMTP → sends to inbox.  
 - Don’t commit real credentials to Git.  
+
+
+## M2M Authentication 
+### Credential generation script
+
+Create client credentials once using the script below.
+The script prints the plain secret once and stores only the hash in DB.
+
+```bash
+backend/app/scripts/generate_credentials.py
+```
+Run command:
+```bash
+python scripts/generate_credentials.py --client-id vachan-nextjs-prod --name "Vachan Online Next.js Prod"
+```
+Example output:
+```bash
+M2M credentials created successfully
+client_id: vachan-nextjs-prod
+client_secret: <generated-secret>
+name: Vachan Online Next.js Prod
+```
+
+### env
+```bash
+JWT_SECRET_KEY=<long-random-string>
+JWT_ALGORITHM=HS256
+M2M_TOKEN_EXPIRE_MINUTES=60
+M2M_REFRESH_TOKEN_EXPIRE_DAYS=30
+```