docs: add comprehensive project wiki for v1.0

Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>

droid-wiki/systems/credential-generation.md

@@ -0,0 +1,45 @@
+# Credential generation
+
+The credential generation module in `src/generate.rs` creates all the certificate and key material needed for a rustunnel session.
+
+## Purpose
+
+Generate a self-signed CA, server certificate, client certificate, and a random auth token. Write them to disk in a specified output directory.
+
+## Key abstractions
+
+| Type/Function | File | Description |
+| ------------- | ---- | ----------- |
+| `GeneratedMaterial` | `src/generate.rs` | Struct holding all generated PEM strings and the auth token |
+| `generate` | `src/generate.rs` | Generate material and write 8 files to an output directory |
+| `generate_material` | `src/generate.rs` | Generate material without writing to disk |
+| `generate_ca` | `src/generate.rs` | Create a self-signed CA with rcgen |
+| `generate_server_cert` | `src/generate.rs` | Create a server cert signed by the CA |
+| `generate_client_cert` | `src/generate.rs` | Create a client cert signed by the CA |
+| `generate_auth_token` | `src/generate.rs` | Generate a 32-byte random hex token |
+
+## Certificate details
+
+- **CA** — CN from `--ca-name`, org "rustunnel", serial 1, constrained CA basic constraints
+- **Server cert** — CN from `--server-name`, org "rustunnel", serial 2, SANs: `localhost`, `rustunnel`, `127.0.0.1`, and optionally the bind IP if not `0.0.0.0` or `::`
+- **Client cert** — CN from `--client-name`, org "rustunnel", serial 3
+- **Auth token** — 64 hex characters (32 random bytes)
+
+## Output files
+
+| File | Content |
+| ---- | ------- |
+| `ca.pem` | CA certificate (PEM) |
+| `ca.key` | CA private key (PEM) |
+| `server.crt` | Server certificate (PEM) |
+| `server.key` | Server private key (PEM) |
+| `client.crt` | Client certificate (PEM) |
+| `client.key` | Client private key (PEM) |
+| `token.txt` | Auth token (plain text) |
+| `config.json` | Paths and default addresses (JSON) |
+
+## Key source files
+
+| File | Purpose |
+| ---- | ------- |
+| `src/generate.rs` | Certificate generation, token generation, file writing |