chore: document auth fixes

docs/runbooks/payments_sanity_check.md

@@ -58,18 +58,18 @@ Expected: server starts at `http://127.0.0.1:8000/`.
 
 ### 4) Obtain a JWT access token
 
+Password token login at `/api/auth/token/` is deprecated for phone-first auth. For this runbook, mint a local JWT in Django shell.
+
 The demo customer is:
 
 - `customer@example.com`
 - `Customer123!`
 
-Fetch the access token:
+Generate an access token:
 
-    curl -s -X POST http://127.0.0.1:8000/api/auth/token/ \
-      -H "Content-Type: application/json" \
-      -d '{"email":"customer@example.com","password":"Customer123!"}'
+    python3 manage.py shell -c "from django.contrib.auth import get_user_model; from rest_framework_simplejwt.tokens import RefreshToken; u=get_user_model().objects.get(email='customer@example.com'); print(str(RefreshToken.for_user(u).access_token))"
 
-Expected: JSON containing `access` and `refresh` tokens.
+Expected: a JWT string printed to stdout. Use it as `<ACCESS>`.
 
 ### 5) Create a payment