Update site for .env keys and pd1 connection invites.

Quick start, operator, security, FAQ, download, home, and learn pages now
point operators at /opt/peardock/.env for public key and seed, and document
viewer / admin / pd1. invite roles.

docs/faq.html

@@ -123,11 +123,35 @@
       </p>
 
       <h2>What do I share with clients?</h2>
-      <p>The server <strong>public key</strong> (64 hex characters). Never share <code>SERVER_SEED</code>.</p>
+      <ul>
+        <li><strong>Viewers:</strong> <code>SERVER_PUBLIC_KEY</code> only (64 hex) — read-only.</li>
+        <li><strong>Admins:</strong> public key + <code>SERVER_SEED</code> (from the same <code>.env</code>) — never send the seed over chat to operators.</li>
+        <li><strong>Operators:</strong> a full <code>pd1.…</code> invite from Access → Create invite (embeds key + capability; no seed).</li>
+      </ul>
+      <p>Never share <code>SERVER_SEED</code> with operators.</p>
 
-      <h2>Where is the public key after install?</h2>
-      <pre><code>sudo journalctl -u peardock -n 80 --no-pager | grep -i 'public key'</code></pre>
-      <p>Also stored under <code>/opt/peardock/.env</code> as <code>SERVER_PUBLIC_KEY</code> when generated.</p>
+      <h2>Where are the public key and seed after install?</h2>
+      <p>
+        After the first successful start, both are written to
+        <code>/opt/peardock/.env</code>. <strong>Check that file:</strong>
+      </p>
+      <pre><code>sudo grep -E '^(SERVER_PUBLIC_KEY|SERVER_SEED)=' /opt/peardock/.env
+# or: sudo cat /opt/peardock/.env
+
+# Public key also appears in the journal
+sudo journalctl -u peardock -n 80 --no-pager | grep -i 'public key'</code></pre>
+      <p>
+        <code>SERVER_PUBLIC_KEY</code> is safe to share for viewer access.
+        <code>SERVER_SEED</code> is admin-only. Keep <code>.env</code> mode 600 and back it up offline.
+      </p>
+
+      <h2>How do invites work?</h2>
+      <p>
+        As admin (public key + <code>SERVER_SEED</code> in Add peer), open <strong>Access → Create invite</strong>
+        and copy the full string starting with <code>pd1.</code>. The operator pastes that entire string in Add peer.
+        Public key and HMAC capability are embedded — no Autopass/RocksDB and no seed sharing.
+        Invites can be persistent (default) or limited by TTL / max uses. Revoke peers from Access when devices are lost.
+      </p>
 
       <h2>Container list empty / “permission denied” on Docker</h2>
       <p>The service user <code>peardock</code> needs the docker group:</p>
@@ -159,8 +183,13 @@ npm run sign:macos -- out/peardock-darwin-arm64/peardock.app</code></pre>
       <h2>Can I run without Holesail?</h2>
       <p>Yes: <code>ENABLE_HOLESAIL=0</code> in the server environment. Control-plane Docker management still works.</p>
 
-      <h2>Default role is admin. Is that safe?</h2>
-      <p>Convenient for a single trusted operator. For multi-operator fleets, set <code>PEARDOCK_DEFAULT_ROLE</code>, <code>PEARDOCK_ADMIN_KEYS</code>, and allowlist. See <a href="/docs/security">threat model</a>.</p>
+      <h2>Default role is viewer. How do I get admin?</h2>
+      <p>
+        Public key alone is <strong>viewer</strong> (read-only). For admin, paste
+        <code>SERVER_PUBLIC_KEY</code> + <code>SERVER_SEED</code> from <code>/opt/peardock/.env</code>
+        in Add peer. For multi-operator fleets, create <code>pd1.</code> invites instead of sharing the seed.
+        Optional: <code>PEARDOCK_ADMIN_KEYS</code>, allowlist. See <a href="/docs/security">threat model</a>.
+      </p>
 
       <h2>v1 vs v2</h2>
       <p>v1 used Hyperswarm topics and raw JSON streams. v2 uses HyperDHT keypairs, public keys, and protomux-rpc. Clients and servers are not wire-compatible across major versions.</p>