docs: add comprehensive project wiki for v1.0

Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>

droid-wiki/reference/configuration.md

@@ -0,0 +1,82 @@
+# Configuration
+
+## CLI arguments
+
+### `listen`
+
+| Argument | Default | Description |
+| -------- | ------- | ----------- |
+| `--listen` | `0.0.0.0:4180` | HTTPS listener bind address |
+| `--advertise` | derived from `--listen` | Public address in auto-generated connection keys |
+| `--connection-key` | none | Reusable key (env: `RUSTUNNEL_KEY`) |
+| `--socks` | none | Server-side SOCKS5 proxy address |
+| `--cert` | "" | Server certificate path |
+| `--key` | "" | Server private key path |
+| `--ca-cert` | "" | CA certificate path |
+| `--auth-token` | "" | Auth token value |
+| `--auth-token-file` | none | Auth token file path |
+| `--insecure-skip-tls-verify` | false | Skip client cert verification |
+
+### `connect`
+
+| Argument | Default | Description |
+| -------- | ------- | ----------- |
+| `CONNECTION_KEY` | none | Positional connection key |
+| `--target` | from key | Listener address |
+| `--connection-key` | none | Key via flag (env: `RUSTUNNEL_KEY`) |
+| `--socks` | `127.0.0.1:1180` | Local SOCKS5 proxy address |
+| `--cert` | "" | Client certificate path |
+| `--key` | "" | Client private key path |
+| `--ca-cert` | "" | CA certificate path |
+| `--auth-token` | "" | Auth token value |
+| `--auth-token-file` | none | Auth token file path |
+| `--insecure-skip-tls-verify` | false | Skip server cert verification |
+
+### `generate`
+
+| Argument | Default | Description |
+| -------- | ------- | ----------- |
+| `--out` | `.` | Output directory |
+| `--ca-name` | `rustunnel-ca` | CA common name |
+| `--server-name` | `rustunnel-server` | Server common name |
+| `--client-name` | `rustunnel-client` | Client common name |
+
+### `keygen`
+
+| Argument | Default | Description |
+| -------- | ------- | ----------- |
+| `--target` | `127.0.0.1:4180` | Listener address embedded in key |
+| `--ca-name` | `rustunnel-ca` | CA common name |
+| `--server-name` | `rustunnel-server` | Server common name |
+| `--client-name` | `rustunnel-client` | Client common name |
+
+## Environment variables
+
+- `RUST_LOG` — tracing filter (e.g., `debug`, `trace`)
+- `RUSTUNNEL_KEY` — connection key for `listen` and `connect`
+
+## Config file format
+
+`config.json` (generated by `rustunnel generate`):
+
+```json
+{
+  "listen_address": "0.0.0.0",
+  "listen_port": 4180,
+  "socks_address": "127.0.0.1",
+  "socks_port": 1180,
+  "ca_cert_path": "ca.pem",
+  "server_cert_path": "server.crt",
+  "server_key_path": "server.key",
+  "client_cert_path": "client.crt",
+  "client_key_path": "client.key",
+  "auth_token_path": "token.txt"
+}
+```
+
+## Key source files
+
+| File | Purpose |
+| ---- | ------- |
+| `src/cli.rs` | clap argument definitions and defaults |
+| `src/config.rs` | `Config` struct for JSON serialization |

droid-wiki/reference/data-models.md

@@ -0,0 +1,93 @@
+# Data models
+
+## ConnectionKey
+
+```rust
+pub struct ConnectionKey {
+    pub version: u8,          // must be 1
+    pub target: String,       // listener address
+    pub ca_cert_pem: String,
+    pub server_cert_pem: String,
+    pub server_key_pem: String,
+    pub client_cert_pem: String,
+    pub client_key_pem: String,
+    pub auth_token: String,
+}
+```
+
+Encoded as: `rtun1.` + base64url(JSON) — no padding.
+
+## Config
+
+```rust
+pub struct Config {
+    pub listen_address: String,
+    pub listen_port: u16,
+    pub socks_address: String,
+    pub socks_port: u16,
+    pub ca_cert_path: String,
+    pub server_cert_path: String,
+    pub server_key_path: String,
+    pub client_cert_path: String,
+    pub client_key_path: String,
+    pub auth_token_path: String,
+}
+```
+
+## Frame
+
+```rust
+pub struct Frame {
+    pub frame_type: u8,   // 0x01 CONNECT, 0x02 CONNECT_REPLY, 0x03 DATA, 0x04 CLOSE, 0x05 ERROR
+    pub stream_id: u64,   // odd for client-initiated
+    pub flags: u8,        // reserved (0x00)
+    pub payload: Bytes,
+}
+```
+
+Wire format: 1 byte type + 8 bytes stream_id (big-endian) + 4 bytes len (big-endian) + 1 byte flags + len bytes payload.
+
+Max payload: 4 MiB.
+
+## Socks5Target
+
+```rust
+pub enum Socks5Target {
+    Ipv4(std::net::Ipv4Addr, u16),
+    Domain { domain: String, port: u16 },
+}
+```
+
+## GeneratedMaterial
+
+```rust
+pub struct GeneratedMaterial {
+    pub ca_cert_pem: String,
+    pub ca_key_pem: String,
+    pub server_cert_pem: String,
+    pub server_key_pem: String,
+    pub client_cert_pem: String,
+    pub client_key_pem: String,
+    pub auth_token: String,
+}
+```
+
+## Error enums
+
+- `TlsError` — missing/invalid certificates, identity mismatch, expiration, verification failure
+- `AuthError` — missing or invalid token
+- `TunnelError` — TLS error, auth error, bind error, connection refused, port in use, protocol error
+- `HostError` — DNS resolution failure, invalid hostname, no addresses
+- `Socks5Error` — invalid version, unsupported auth/command/addr type, parse errors
+- `FrameError` — frame too short, payload overflow, I/O error, protocol error
+
+## Key source files
+
+| File | Purpose |
+| ---- | ------- |
+| `src/connkey.rs` | `ConnectionKey` |
+| `src/config.rs` | `Config` |
+| `src/framing.rs` | `Frame`, `FrameReader`, `FrameWriter` |
+| `src/socks5.rs` | `Socks5Target`, `Socks5State`, `Socks5Error` |
+| `src/generate.rs` | `GeneratedMaterial` |
+| `src/errors.rs` | `TlsError`, `AuthError`, `TunnelError`, `HostError` |

droid-wiki/reference/dependencies.md

@@ -0,0 +1,45 @@
+# Dependencies
+
+## Runtime dependencies
+
+| Crate | Version | Purpose |
+| ----- | ------- | ------- |
+| `clap` | 4 | CLI parsing with derive macros |
+| `tokio` | 1 | Async runtime (full features) |
+| `tokio-util` | 0.7 | I/O utilities |
+| `tracing` | 0.1 | Structured logging |
+| `tracing-subscriber` | 0.3 | Log formatting with env-filter |
+| `anyhow` | 1 | Application error handling |
+| `thiserror` | 1 | Library error enums |
+| `serde` | 1 | Serialization (derive) |
+| `serde_json` | 1 | JSON encoding/decoding |
+| `rcgen` | 0.14 | Certificate generation |
+| `x509-parser` | 0.16 | Certificate parsing for identity validation |
+| `time` | 0.3 | Date/time formatting for certificate validity |
+| `rand` | 0.8 | Random token generation |
+| `hex` | 0.4 | Hex encoding for auth tokens |
+| `rustls` | 0.23 | TLS implementation (ring provider) |
+| `rustls-pki-types` | 1 | rustls type definitions |
+| `rustls-pemfile` | 2 | PEM parsing for certificates and keys |
+| `tokio-rustls` | 0.26 | Tokio integration for rustls |
+| `hyper` | 1 | HTTP types (used for auth handshake) |
+| `hyper-util` | 0.1 | HTTP utilities |
+| `http-body-util` | 0.1 | HTTP body utilities |
+| `tower-service` | 0.3 | Service trait (Hyper ecosystem) |
+| `base64` | 0.22 | Connection key encoding |
+| `sha2` | 0.10 | Certificate fingerprinting |
+| `bytes` | 1 | Byte buffers for framing |
+| `futures` | 0.3 | Future utilities |
+| `url` | 2 | URL parsing |
+
+## Dev dependencies
+
+| Crate | Version | Purpose |
+| ----- | ------- | ------- |
+| `tempfile` | 3 | Temporary directories for tests |
+
+## Key source files
+
+| File | Purpose |
+| ---- | ------- |
+| `Cargo.toml` | Dependency declarations and features |

droid-wiki/reference/index.md

@@ -0,0 +1,7 @@
+# Reference
+
+Configuration, data models, and external dependencies.
+
+- [Configuration](configuration.md)
+- [Data models](data-models.md)
+- [Dependencies](dependencies.md)