docs: update BACKOFFICE.md with distroless and jwt details

docs/BACKOFFICE.md

@@ -33,12 +33,19 @@ DELETE /api/admin/settings/:key → Remover
 - Usuários ativos
 - Pedidos pendentes
 
+## 🚀 Deployment
+
+The service is containerized using **Google Distroless** images (`gcr.io/distroless/nodejs22-debian12`) for maximum security and minimal footprint.
+Verified locally using `JWT_SECRET` shared with the backend.
+
 ## Variáveis de Ambiente
 
 ```bash
 DATABASE_URL=postgres://...
-JWT_SECRET=your-secret
-ENCRYPTION_KEY=32-byte-key-for-aes-256
+JWT_SECRET=dev-secret         # Must match backend secret for local verification
+PORT=3000
+API_URL=http://localhost:8214
+ENCRYPTION_KEY=...
 ```
 
 ## Executar