docs: add comprehensive project wiki for v1.0

Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>

droid-wiki/reference/configuration.md

@@ -0,0 +1,82 @@
+# Configuration
+
+## CLI arguments
+
+### `listen`
+
+| Argument | Default | Description |
+| -------- | ------- | ----------- |
+| `--listen` | `0.0.0.0:4180` | HTTPS listener bind address |
+| `--advertise` | derived from `--listen` | Public address in auto-generated connection keys |
+| `--connection-key` | none | Reusable key (env: `RUSTUNNEL_KEY`) |
+| `--socks` | none | Server-side SOCKS5 proxy address |
+| `--cert` | "" | Server certificate path |
+| `--key` | "" | Server private key path |
+| `--ca-cert` | "" | CA certificate path |
+| `--auth-token` | "" | Auth token value |
+| `--auth-token-file` | none | Auth token file path |
+| `--insecure-skip-tls-verify` | false | Skip client cert verification |
+
+### `connect`
+
+| Argument | Default | Description |
+| -------- | ------- | ----------- |
+| `CONNECTION_KEY` | none | Positional connection key |
+| `--target` | from key | Listener address |
+| `--connection-key` | none | Key via flag (env: `RUSTUNNEL_KEY`) |
+| `--socks` | `127.0.0.1:1180` | Local SOCKS5 proxy address |
+| `--cert` | "" | Client certificate path |
+| `--key` | "" | Client private key path |
+| `--ca-cert` | "" | CA certificate path |
+| `--auth-token` | "" | Auth token value |
+| `--auth-token-file` | none | Auth token file path |
+| `--insecure-skip-tls-verify` | false | Skip server cert verification |
+
+### `generate`
+
+| Argument | Default | Description |
+| -------- | ------- | ----------- |
+| `--out` | `.` | Output directory |
+| `--ca-name` | `rustunnel-ca` | CA common name |
+| `--server-name` | `rustunnel-server` | Server common name |
+| `--client-name` | `rustunnel-client` | Client common name |
+
+### `keygen`
+
+| Argument | Default | Description |
+| -------- | ------- | ----------- |
+| `--target` | `127.0.0.1:4180` | Listener address embedded in key |
+| `--ca-name` | `rustunnel-ca` | CA common name |
+| `--server-name` | `rustunnel-server` | Server common name |
+| `--client-name` | `rustunnel-client` | Client common name |
+
+## Environment variables
+
+- `RUST_LOG` — tracing filter (e.g., `debug`, `trace`)
+- `RUSTUNNEL_KEY` — connection key for `listen` and `connect`
+
+## Config file format
+
+`config.json` (generated by `rustunnel generate`):
+
+```json
+{
+  "listen_address": "0.0.0.0",
+  "listen_port": 4180,
+  "socks_address": "127.0.0.1",
+  "socks_port": 1180,
+  "ca_cert_path": "ca.pem",
+  "server_cert_path": "server.crt",
+  "server_key_path": "server.key",
+  "client_cert_path": "client.crt",
+  "client_key_path": "client.key",
+  "auth_token_path": "token.txt"
+}
+```
+
+## Key source files
+
+| File | Purpose |
+| ---- | ------- |
+| `src/cli.rs` | clap argument definitions and defaults |
+| `src/config.rs` | `Config` struct for JSON serialization |