docs: correct the self-hosted server path and document server.toml

Audit of the public repo against the actual server and konduit-ctl source.
The happy path was documented; the failure modes were not.

- server.toml had no reference at all. Add docs/server-config.md covering
  every key, [tls], the control API, and key handling.
- The mantra could not recover the identity key on its own:
  derive_from_passphrase needs the [kdf] salt, which is 32 random bytes
  generated once at bootstrap. bootstrap says so in the file it generates
  (core/src/config.rs:403); the quickstart claimed the opposite. Fixed, with
  a backup step added before it is needed rather than after.
- konduit-server never appeared in a download step, yet
  konduit-server.service expects /opt/konduit/konduit-server - a path no
  instruction created. Added the install section and moved setcap after the
  copy, since capabilities do not survive every cross-filesystem copy and a
  binary that silently lost cap_net_bind_service fails at bind time.
- Hot config reload was a headline feature with no documented mechanism. It
  is a control API on 127.0.0.1:3001, and add-client only edits the file on
  disk, so a new peer is not live until something reloads it. Documented,
  including that /reload does not disconnect revoked peers but /sync does.
- [tls] native termination was entirely undocumented; the key must be PKCS#8.
- Dropped a README claim about a konduit-admin-ui unit that does not exist,
  and fixed a systemd copy path that only resolved if this repo had been
  cloned to /opt/konduit.

#k-ops/#1/#211

README.md

@@ -60,16 +60,22 @@ rather than assuming a row is present. Android is on Google Play either way.
 ### Linux (CLI)
 
 ```bash
-# Download konduit and konduit-ctl from the Releases page, then:
-chmod +x konduit konduit-ctl
+# Download konduit-server, konduit-ctl and konduit from the Releases page, then:
+chmod +x konduit-server konduit-ctl konduit
 
-# Bootstrap a server
+# Bootstrap a server (run from the directory that will hold server.toml)
 echo "your secret mantra" | ./konduit-ctl bootstrap -l vpn.example.com:443 -p -
 
+# Add a client, and reload the server so it picks the peer up
+./konduit-ctl add-client my-laptop --reload
+
 # Connect a client
-./konduit --config client.toml
+./konduit --config my-laptop.client.toml
 ```
 
+Running a server end to end — install, capabilities, NAT, systemd — is covered
+in the [Server Quickstart](docs/server-quickstart.md).
+
 `--config`/`-c` is a top-level flag, not a `connect` flag. The `connect`
 subcommand takes the peer details individually instead:
 
@@ -108,9 +114,10 @@ Coming soon.
 **CLI & server**
 - [Client Quickstart](docs/client-quickstart.md) — download, configure, connect, run as a systemd service
 - [Server Quickstart](docs/server-quickstart.md) — install, provision, NAT setup for iptables and firewalld
+- [Server Configuration](docs/server-config.md) — every `server.toml` key, the control API, and how the server identity key is protected
 - [SOCKS5 Modes](docs/socks-modes.md) — reach the server through a proxy, or expose a local SOCKS5 listener
 - [Connection Tuning](docs/connection-tuning.md) — opt-in connection pooling for unstable links
-- [systemd units](docs/systemd/) — service files for konduit-server, konduit (client), and konduit-admin-ui
+- [systemd units](docs/systemd/) — service files for konduit-server and konduit (client)
 
 ## Architecture