fix: harden pairing flow

docs/start/pairing.md

@@ -22,6 +22,10 @@ When a provider is configured with DM policy `pairing`, unknown senders get a sh
 
 Default DM policies are documented in: [Security](/gateway/security)
 
+Pairing codes:
+- 8 characters, uppercase, no ambiguous chars (`0O1I`).
+- **Expire after 1 hour**. The bot only sends the pairing message when a new request is created (roughly once per hour per sender).
+
 ### Approve a sender
 
 ```bash