docs(radius): app password lifetime cap is 30 days without the attribute

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/radius/dot1x.md

@@ -162,10 +162,11 @@ WLANs that advertise Hotspot 2.0 with domain and NAI realm `renner.uno`
 (EAP-TTLS/PAP).
 
 App password lifetimes are capped by the group attribute
-`goauthentik.io/user/token-maximum-lifetime` (default: the token default of
-30 minutes). WLAN users need a group with
-`goauthentik.io/user/token-maximum-lifetime: days=3650`, or the creation fails
-(502 on the callback, reason in the wlan-setup log).
+`goauthentik.io/user/token-maximum-lifetime` (without it: 30 days). WLAN users
+need a group with `goauthentik.io/user/token-maximum-lifetime: days=3650`, or
+the creation fails with `Token expires exceeds maximum lifetime` (502 on the
+callback, reason in the wlan-setup log). Creating the app password needs no
+admin rights.
 
 All clients use EAP-TTLS with inner PAP. The server certificate is a public
 Let's Encrypt certificate for `radius.renner.uno`, so no CA needs to be