update docs

docs/bmlapi/03-oauth-token.md

@@ -135,19 +135,21 @@ POST https://www.bankofmaldives.com.mv/internetbanking/oauth/token
 
 **Content-Type:** `application/x-www-form-urlencoded`
 
+**HTTP `User-Agent` header**: the browser/web UA (same as the initial token exchange), not the app UA. See `BmlLoginFlow.kt:341`.
+
 | Field | Value |
 |---|---|
 | `grant_type` | `refresh_token` |
 | `refresh_token` | Stored refresh token |
 | `client_id` | `98C83590-513F-4716-B02B-EC68B7D9E7E7` |
 | `Device-ID` | Same device ID from the original login |
-| `User-Agent` | App user agent string |
+| `User-Agent` | App user agent string (form field — distinct from the HTTP header above) |
 | `x-app-version` | `2.1.44.348` |
 
 ```bash
 curl --request POST \
   --url 'https://www.bankofmaldives.com.mv/internetbanking/oauth/token' \
-  --header 'User-Agent: bml-mobile-banking/348 ({manufacturer}; Android {version}; {model})' \
+  --header 'User-Agent: Mozilla/5.0 (Linux; Android {version}; {model}) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/... Mobile Safari/537.36' \
   --data 'grant_type=refresh_token' \
   --data 'refresh_token=def50200aabbcc...' \
   --data 'client_id=98C83590-513F-4716-B02B-EC68B7D9E7E7' \