fix(notifications): keep a quick answer single-use after its entry is purged and document the topic exposure

docs/self-hosting/notifications.md

@@ -529,13 +529,31 @@ token is the only credential, so it is built to be harmless on its own:
   answer, so it cannot be moved to another account or another answer;
 - it expires six hours after the reminder was sent;
 - the three answers of one reminder are one use between them: the first
-  tap logs, every later tap on that reminder is refused;
+  tap logs, every later tap on that reminder is refused, and that stays
+  true when the logged entry is deleted and purged from the trash before
+  the six hours are up;
 - the route is rate-limited before it reads the token, refuses when the
   mood module has been turned off, and the token is scrubbed from logs.
 
 The buttons need `APP_URL`, because the ntfy app calls the URL from your
 phone. Your phone has to reach the instance at that address.
 
+What the token cannot protect against is the topic itself. The button URLs,
+token included, travel through your ntfy server inside the message, and the
+message is delivered to everyone subscribed to the topic. For the six hours
+a token is valid, anyone who can read the topic can log that one answer on
+your behalf. On the public `ntfy.sh` the topic name is the only access
+control, so:
+
+- use a long, random topic name and do not share it;
+- better, run your own ntfy server with access control and give HealthLog
+  an access token that may only publish to your topic;
+- to invalidate every quick-answer token at once, rotate
+  `API_TOKEN_HMAC_KEY`. The same key also hashes API tokens and session
+  cookies, so rotating it invalidates every issued API token and signs out
+  every browser session and the iOS app as well (see
+  [getting started](./getting-started.md)).
+
 **Telegram** keeps its own keyboard on the mood reminder: the full 1 to 5
 scale, a note and a "later" button.