docs: Updated docs

docs/reference/rest-api.md

@@ -12,7 +12,7 @@ has no privileges it does not.
 Most endpoints take a session: an opaque 32-byte token in the `km_session`
 cookie, with the body in Redis for 24 hours.
 
-One endpoint takes a bearer token instead — the External Secrets Operator read
+One endpoint takes a bearer token instead the External Secrets Operator read
 path.
 
 ## Unauthenticated
@@ -119,14 +119,14 @@ GET,PUT    /org/oidc                         (owner|admin)
 
 ## Notable refusals
 
-| Endpoint | Condition | Status |
-| --- | --- | --- |
-| `POST /license` | deployment is `cloud` | `409 cloud_managed` |
-| `PUT,DELETE /steps/:id` | the step's source is `default` | `409` |
-| `PUT /org/users/:id/role`, `DELETE /org/users/:id` | the user's auth source is `hq` | `409` |
+| Endpoint                                           | Condition                      | Status              |
+| -------------------------------------------------- | ------------------------------ | ------------------- |
+| `POST /license`                                    | deployment is `cloud`          | `409 cloud_managed` |
+| `PUT,DELETE /steps/:id`                            | the step's source is `default` | `409`               |
+| `PUT /org/users/:id/role`, `DELETE /org/users/:id` | the user's auth source is `hq` | `409`               |
 
 `POST /license` is exempt from the licence check, so pasting a valid licence
-works while the current one is expired — that is the way out of degraded mode.
+works while the current one is expired that is the way out of degraded mode.
 
 ## Multi-tenancy
 
@@ -143,7 +143,7 @@ session and does not need that distinction.
 
 ## Admin API
 
-The HQ service has its own API, its own database and its own session cookie
-(`admin_session`) on port `8083`. It is documented in the
-[Vantage HQ](../hq/accounts-and-signup.md) section rather than here; the two
-services share no session and no authentication.
+Vantage HQ is a separate hosted service with its own API and its own session.
+Its behaviour is described in the [Vantage HQ](../hq/accounts-and-signup.md)
+section rather than here; the two services share no session and no
+authentication.