Update site for .env keys and pd1 connection invites.

Quick start, operator, security, FAQ, download, home, and learn pages now
point operators at /opt/peardock/.env for public key and seed, and document
viewer / admin / pd1. invite roles.

learn/index.html

@@ -217,9 +217,11 @@ flowchart LR
       </div>
 
       <p>
-        On first start the server prints the public key (also in the journal when using systemd).
+        On first start the server writes <code>SERVER_SEED</code> and <code>SERVER_PUBLIC_KEY</code> to
+        <code>/opt/peardock/.env</code> (mode 600) and prints the public key in the journal.
+        <strong>Check the <code>.env</code> file</strong> for both values before connecting.
         Rotating the seed changes the public key. All clients must re-add the peer.
-        Back up <code>/opt/peardock/.env</code> (or your dev <code>.env</code>) like any other root secret.
+        Back up that file like any other root secret.
       </p>
 
       <div class="callout warn">
@@ -445,8 +447,9 @@ flowchart LR
 
       <ul>
         <li><strong>Transport encryption:</strong> Noise on the HyperDHT stream, not cleartext Docker API on :2375.</li>
-        <li><strong>Roles:</strong> viewer, operator, and admin gate methods server-side.</li>
-        <li><strong>Peer policy:</strong> optional allowlists, invites, and revoke for multi-operator fleets without sharing root SSH.</li>
+        <li><strong>Roles:</strong> viewer (default for public key alone), operator, and admin gate methods server-side.</li>
+        <li><strong>Keys in <code>.env</code>:</strong> after install, check <code>/opt/peardock/.env</code> for <code>SERVER_PUBLIC_KEY</code> and <code>SERVER_SEED</code>.</li>
+        <li><strong>Peer policy:</strong> optional allowlists, <code>pd1.</code> invites (no seed sharing), and revoke for multi-operator fleets.</li>
         <li><strong>Rate limits and audit:</strong> blunt force protection and accountability for privileged calls.</li>
         <li><strong>Registry vault:</strong> credentials encrypted at rest (AES-GCM keyed from server material).</li>
         <li><strong>Tunnel SSRF guard:</strong> default allowlist for tunnel targets (loopback and published binds).</li>
@@ -484,9 +487,9 @@ flowchart LR
 
       <pre class="mermaid">
 flowchart TB
-  A[Install peardock-server on Docker host] --> B[Read public key from journal]
+  A[Install peardock-server on Docker host] --> B["Read keys from /opt/peardock/.env"]
   B --> C[Install desktop client]
-  C --> D[Add peer · paste public key]
+  C --> D[Add peer · key / seed / pd1 invite]
   D --> E[Handshake · role · protocol version]
   E --> F[listContainers · stats pushes · manage]
   F --> G{Need app traffic?}
@@ -496,8 +499,8 @@ flowchart TB
 
       <ol>
         <li>Install the server (one-liner or binary) on a machine with Docker.</li>
-        <li>Copy the <strong>public key</strong> from logs / journal.</li>
-        <li>Install the client; add the peer; wait for health (latency, Docker ok, role).</li>
+        <li>Read <code>SERVER_PUBLIC_KEY</code> and (for admin) <code>SERVER_SEED</code> from <code>/opt/peardock/.env</code>.</li>
+        <li>Install the client; Add peer with key / key+seed / full <code>pd1.</code> invite; wait for health.</li>
         <li>Operate: deploy, logs, terminal, stacks, Swarm, prune, schedules…</li>
         <li>Optionally tunnel a published port with Holesail for users outside the control path.</li>
       </ol>
@@ -535,7 +538,11 @@ flowchart TB
         </details>
         <details>
           <summary>Public key vs SERVER_SEED</summary>
-          <p>The seed is secret server identity material. The public key is what clients dial. Sharing the seed is equivalent to handing over the server identity.</p>
+          <p>Both are written to <code>/opt/peardock/.env</code> on first start. The public key is what clients dial (viewer if used alone). The seed is secret server identity — paste it with the public key for admin only. Sharing the seed is equivalent to handing over admin.</p>
+        </details>
+        <details>
+          <summary>pd1. invite</summary>
+          <p>Self-contained peardock share string from Access → Create invite. Embeds public key + HMAC capability so operators connect without receiving <code>SERVER_SEED</code>. Paste the full string in Add peer (never truncate).</p>
         </details>
         <details>
           <summary>Holesail / hs://</summary>