docs: correct the self-hosted server path and document server.toml

Audit of the public repo against the actual server and konduit-ctl source.
The happy path was documented; the failure modes were not.

- server.toml had no reference at all. Add docs/server-config.md covering
  every key, [tls], the control API, and key handling.
- The mantra could not recover the identity key on its own:
  derive_from_passphrase needs the [kdf] salt, which is 32 random bytes
  generated once at bootstrap. bootstrap says so in the file it generates
  (core/src/config.rs:403); the quickstart claimed the opposite. Fixed, with
  a backup step added before it is needed rather than after.
- konduit-server never appeared in a download step, yet
  konduit-server.service expects /opt/konduit/konduit-server - a path no
  instruction created. Added the install section and moved setcap after the
  copy, since capabilities do not survive every cross-filesystem copy and a
  binary that silently lost cap_net_bind_service fails at bind time.
- Hot config reload was a headline feature with no documented mechanism. It
  is a control API on 127.0.0.1:3001, and add-client only edits the file on
  disk, so a new peer is not live until something reloads it. Documented,
  including that /reload does not disconnect revoked peers but /sync does.
- [tls] native termination was entirely undocumented; the key must be PKCS#8.
- Dropped a README claim about a konduit-admin-ui unit that does not exist,
  and fixed a systemd copy path that only resolved if this repo had been
  cloned to /opt/konduit.

#k-ops/#1/#211

docs/client-quickstart.md

@@ -39,11 +39,15 @@ connected · no udp, no root, port 443
 To connect automatically on boot, use the provided systemd unit:
 
 ```bash
-sudo cp /opt/konduit/docs/systemd/konduit.service /etc/systemd/system/
+# konduit.service ships in this repo at docs/systemd/ — copy it from the repo root
+sudo cp docs/systemd/konduit.service /etc/systemd/system/
 sudo systemctl daemon-reload
 sudo systemctl enable --now konduit
 ```
 
+The unit expects the binary at `/opt/konduit/konduit` and the config at
+`/opt/konduit/client.toml` — edit both paths if you installed elsewhere.
+
 The unit runs as root (required for TUN device creation) and restarts automatically on failure.
 
 ## 5. Capabilities (alternative to root)