GRM-43: docs: fix broken wiki links and add missing token setup steps

docs/user/faq.md

@@ -2,7 +2,21 @@
 
 ### How do I obtain the Gitea registration token?
 
-The runner registration token is obtained from your Gitea instance: **Admin → Actions → Runners → Create Registration Token**. Set it as `GITEA_REGISTRATION_TOKEN` in your `.env` file or pass it via `--token` on the command line.
+There are three levels of registration tokens, depending on which repositories the runner should serve:
+
+- **Instance-level** — Site Administration → Actions → Runners → Create Registration Token. The runner will handle jobs from all repositories.
+- **Organization-level** — Organization → Settings → Actions → Runners → Create Registration Token. The runner will only handle jobs from repositories in that organization.
+- **Repository-level** — Repository → Settings → Actions → Runners → Create Registration Token. The runner will only handle jobs from that specific repository.
+
+Set the token as `GITEA_REGISTRATION_TOKEN` in your `.env` file or pass it via `--token` on the command line.
+
+### What is the REPO_TOKEN and do I need it?
+
+`REPO_TOKEN` is a Gitea admin API token used for optional post-install verification. When set, GRM queries the Gitea API after installation to confirm the runner appears in the runner list. This is purely informational — the integration test passes/fails based on the `.runner` file and systemd service, not the API check.
+
+To generate one: Settings → Applications → Generate New Token, with the `admin` scope (or at minimum `read:user`, `read:repository`, `read:admin`).
+
+If you skip it, GRM will still verify the runner correctly — it just won't show the extra API confirmation.
 
 ### How do I skip the sudo password prompt for automation?