docs: improve token instructions

Ensure users are aware they need to use a personal access token to have
private stats show up on the card.

Author: rickstaa

README.md

@@ -68,7 +68,7 @@ This action is a recommended deployment option. You can also deploy on Vercel or
 - `card` (required): Card type. Supported: `stats`, `top-langs`, `pin`, `wakatime`, `gist`.
 - `options`: Card options as a query string (`key=value&...`) or JSON. If `username` is omitted, the action uses the repository owner.
 - `path`: Output path for the SVG file. Defaults to `profile/<card>.svg`.
-- `token`: GitHub token (PAT or `GITHUB_TOKEN`).
+- `token`: GitHub token (PAT or `GITHUB_TOKEN`). For private repo stats, use a [PAT](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens) with `repo` and `read:user` scopes.
 
 ## Examples
 
@@ -120,4 +120,3 @@ with:
 ## Notes
 
 - This action uses the same renderers and fetchers as [readme-tools/github-readme-stats](https://github.com/readme-tools/github-readme-stats).
-- For higher API limits, use a [PAT](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens) with `public_repo` scope.