docs: document BGFILTER_AUTH_TOKEN auth and despill-off default

DEPLOY.md / DEPLOY_ZH.md:
- add BGFILTER_AUTH_TOKEN to the env-var table
- new "Authentication" subsection under §10: opt-in token via the
  X-Genarrative-Image-Token header (401 on missing/wrong), fail-open when
  unset (proxy handles it), /healthz always open; drop the stale "no
  authentication" line
- note that despill is off by default (same-hue false-positive)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

DEPLOY.md

@@ -202,6 +202,7 @@ redirect back to `huggingface.co`, which recent `huggingface_hub` rejects with
 | `BGFILTER_MAX_IMAGE_PIXELS` | `4194304` | Reject larger inputs with `413` (~4 MP) |
 | `BGFILTER_PRELOAD` | `1` | Load default models at startup (first request isn't cold) |
 | `BGFILTER_CROSS_CHECK` | config (`on`) | Force the cross-check veto on/off (`0` disables; needs `BiRefNet_HR-matting`) |
+| `BGFILTER_AUTH_TOKEN` | — | If set, `/remove-background` requires header `X-Genarrative-Image-Token` to equal it (constant-time; `401` otherwise). Unset = **open** (auth left to a fronting proxy). `/healthz` stays open. See §10. |
 | `BGFILTER_WEIGHTS_DIR` | `models` | Where local weight folders are looked up (Option B) |
 | `HF_HOME` | — | HF cache location (Option A) |
 | `HF_HUB_OFFLINE` / `TRANSFORMERS_OFFLINE` | — | Set to `1` in production once weights are cached |
@@ -233,6 +234,12 @@ Two model knobs live in the **config file** (`model:` section), not env vars:
 | `model.precision` | `fp32` | `fp32` or `bf16`. bf16 is used **only** on hardware with native kernels (CUDA, or a CPU with AVX512-BF16/AMX); otherwise it warns and falls back to fp32. Also settable per model under `segmentation:` / `cross_check:`. |
 | `model.attn_query_chunk` | `2048` | Query-row chunk for ViTMatte's global attention. Smaller (e.g. `512`) caps the O(N²) memory transient for a few % more compute; output is bit-for-bit identical. `0` disables chunking (stock one-shot attention). |
 
+> **Despill is off by default** (all lanes, cpu-fast included). It pulls foreground
+> chroma along the background-hue axis with no positional/semantic guard, so a subject
+> sharing the background's hue (e.g. a blue suit on a blue backdrop) gets desaturated /
+> hue-shifted (~ΔE 35). Re-enable per-config with `despill: {enabled: true}` only when
+> edge-spill removal matters more than same-hue fidelity.
+
 ## 7. Run the service
 
 ```bash
@@ -308,13 +315,34 @@ curl -sS -F "file=@input.png" -F "screen_color=#CFEFFF" \
 ## 10. Exposing the service
 
 The unit binds `127.0.0.1` — intended to be called by a co-located client (e.g. the
-Genarrative Rust BFF via `GENARRATIVE_EDITOR_BACKGROUND_REMOVAL_BASE_URL`). The
-service has **no authentication**. To reach it from other hosts:
+Genarrative Rust BFF via `GENARRATIVE_EDITOR_BACKGROUND_REMOVAL_BASE_URL`). To reach
+it from other hosts:
 
 - **Reverse proxy (recommended):** put nginx/caddy in front, terminate TLS, add
-  auth/rate-limiting, and forward to `127.0.0.1:18083`.
+  rate-limiting, and forward to `127.0.0.1:18083`.
 - **Direct:** change `--host` to `0.0.0.0` and restrict source IPs with a firewall.
-  Do not expose it unauthenticated to the public internet.
+  Do not expose it to the public internet without authentication (below).
+
+### Authentication
+
+App-level token auth is **opt-in** via `BGFILTER_AUTH_TOKEN`:
+
+- **Set it** → `/remove-background` requires header `X-Genarrative-Image-Token: <token>`
+  (constant-time compare); missing or wrong returns `401`. `/healthz` stays open. Use
+  this whenever the app is reachable directly — `--host 0.0.0.0`, or a cloud port
+  mapping with no proxy in front.
+- **Leave it unset** → the app is **open** (fail-open) and logs a startup WARNING.
+  Correct only when a fronting proxy already authenticates — e.g. the production nginx
+  checks `X-Genarrative-Image-Token` itself, so the app behind it needs no token.
+
+The header name matches the nginx layer, so a caller only swaps the base URL + token
+value — no request-shape change:
+
+```bash
+curl -H "X-Genarrative-Image-Token: <token>" \
+  -F "file=@input.png" \
+  https://<host>/remove-background -o out.png
+```
 
 ## 11. Capacity & performance