docs(pam): correct journalctl recipe — tag is caller-set, grep is universal

pam/TESTING.md

@@ -47,8 +47,19 @@ for u in "../etc" "a/b" "" "." ".." "x..y"; do
 done
 ```
 
-Logs show up via `journalctl -t authforge_pending` (or wherever your
+The module logs via `pam_syslog` without setting its own `openlog` ident,
-distribution routes `pam_syslog` — typically `/var/log/auth.log`).
+so journal entries inherit the calling process's syslog identifier:
+`pamtester` here, `sudo` / `sshd` / `gdm` / `login` in production. The
+module name appears in the message body, so the always-works query is to
+grep for the literal string:
+
+```bash
+journalctl --since "10 minutes ago" --no-pager | grep authforge_pending
+```
+
+For pamtester runs specifically, `journalctl -t pamtester` works too.
+Older systems that route `pam_syslog` to `/var/log/auth.log` show the
+same lines there.
 
 ## Smoke test 4: recovery-code path (Phase 12)