docs(postman): add gRPC auth collection

postman/README.md

@@ -0,0 +1,67 @@
+# Postman gRPC Guide
+
+Use these files with the running Docker Compose stack:
+
+```bash
+docker compose up --build
+```
+
+Import `Gapido Auth gRPC.postman_environment.json` into Postman and select it as the active environment.
+
+## Create the gRPC Requests
+
+Postman's HTTP collection JSON is not a perfect carrier for executable gRPC requests. Use `Gapido Auth gRPC.postman_collection.json` as a request reference, then create gRPC requests in Postman with:
+
+- Server URL: `{{grpc_host}}`
+- Proto file: `proto/gapido_auth/generated/auth.proto`
+- Service: `gapido.auth.v1.AuthService`
+
+## Request Order
+
+1. `RequestOtp`
+
+```json
+{
+  "mobile": "{{mobile}}",
+  "purpose": "{{purpose}}"
+}
+```
+
+2. Get the OTP.
+
+With local debug mode, open `http://localhost:8080`, enter the same mobile number, and use `Use Debug OTP`; or read the Redis key:
+
+```text
+debug:sms:last:{{mobile}}
+```
+
+3. `VerifyOtp`
+
+```json
+{
+  "mobile": "{{mobile}}",
+  "code": "{{otp_code}}",
+  "purpose": "{{purpose}}"
+}
+```
+
+Copy `access_token` and `refresh_token` from the response into the active Postman environment.
+
+4. Protected calls
+
+For `UserOnly`, `AdminOnly`, and `RevokeRefreshToken`, add metadata:
+
+```text
+authorization: Bearer {{access_token}}
+```
+
+5. `RefreshToken`
+
+```json
+{
+  "refresh_token": "{{refresh_token}}"
+}
+```
+
+Refresh rotates the refresh token, so update both token variables after a successful response.
+