docs(public): remove stealth-mode content, add SOCKS5 modes and connection tuning docs

docs/connection-tuning.md

@@ -0,0 +1,20 @@
+# Connection Tuning
+
+Konduit is a TCP-native VPN. On stable networks, a single TCP connection works fine. On unstable links (spotty Wi-Fi, mobile data, satellite), you can opt into a small pool of pre-warmed connections so a failing connection can be replaced without a full reconnect cascade.
+
+## Config
+
+```toml
+[connection]
+pool_enabled = false    # default off; opt in for unstable links
+pool_size = 3           # pre-warmed idle connections when enabled
+carry_duration = 1.0    # seconds an active connection carries traffic before handoff
+```
+
+- `pool_enabled` — when `true`, the client keeps `pool_size` extra pre-authenticated connections warm, so an in-use connection can fail over instantly instead of paying a fresh TCP-plus-handshake cost.
+- `pool_size` — number of pre-warmed idle connections to keep, in addition to the active one. Only used when `pool_enabled = true`.
+- `carry_duration` — how long (in seconds) an active connection carries traffic before handoff to a pre-warmed one. Only used when `pool_enabled = true`.
+
+This is a resilience feature, not a stealth feature — it exists purely to make konduit more tolerant of flaky links, and has no effect on how konduit's traffic looks to a network observer.
+
+Server-side, sticky DL-target routing keeps your active connection selected until it actually fails (detected via a write timeout), rather than rotating on a fixed timer. This needs no client-side configuration.