docs: document tubco pat auth workflow

backend/workflows/templates/workflows/developer_handbook.html

@@ -698,6 +698,7 @@ docker compose restart worker</code></pre>
 ./scripts/git_remote_target.sh set-tubco-identity</code></pre>
       <p>Switch between the normal commit identity and the TUBCO customer identity when needed.</p>
       <p>For the TUBCO HTTPS remote, prefer a personal access token instead of a reusable account password.</p>
+      <p>This repo now uses <code>credential.helper=osxkeychain</code> locally, so the TUBCO PAT should be stored in the macOS keychain instead of being embedded in remote URLs.</p>
     </div>
     <div class="box">
       <h3>Direct server deployment</h3>