[emupton]

Why

Console is introducing the ApplicationToken kind, scoped to a self-serve Application, closing a vulnerability where an ApplicationInstance token (e.g. a dev environment's CI token) could modify ApplicationGroups and grant itself production access. PRs 1-2 of this stack added the commands; the docs and help text still described only Admin and Application Instance tokens.

What this PR does

• README: the token-kinds sentence now names the three kinds (Admin, Application — scoped to a self-serve Application — and Application Instance) and the example no longer implies CDK_API_KEY must be an admin token.
• docs/env-var-config.md: same for the CDK_API_KEY entry.
• conduktor token Short help and the root command's Long help mention Application tokens.
• Fixes a pre-existing help-text bug: token create admin said you can authenticate with CDK_USER/CDK_PASSWORD "instead of CDK_TOKEN" — the variable the CLI actually reads is CDK_API_KEY.

Milestone: docs match reality.

How to verify

./conduktor token --help
./conduktor token create admin --help
grep -rn CDK_TOKEN .   # no hits

Stack: PR 3/4, on top of #157.

🤖 Generated with Claude Code