Document .env keys after install and pd1 invite flow.

Installer and operator docs now tell users to read SERVER_PUBLIC_KEY and
SERVER_SEED from /opt/peardock/.env, and how to connect as viewer, admin, or
via a pd1. invite without sharing the seed.

scripts/install.sh

@@ -462,10 +462,10 @@ EOF
     if confirm "Enable and start peardock.service now?" "y"; then
       run_root systemctl enable --now peardock.service
       ok "Service peardock.service is enabled and started"
-      sleep 1
+      # First start generates SERVER_SEED + SERVER_PUBLIC_KEY into .env
+      sleep 2
       run_root systemctl --no-pager --full status peardock.service || true
       log "Logs: journalctl -u peardock -f"
-      log "Public key (if ready): journalctl -u peardock -n 50 --no-pager | grep -i 'public key' || true"
     else
       ok "Unit installed. Start later with: sudo systemctl enable --now peardock"
     fi
@@ -473,15 +473,58 @@ EOF
     warn "systemctl not found — binary installed at ${SERVER_DIR}/peardock-server (start manually)"
   fi
 
+  # Prefer showing public key from .env once the server has written it (never print seed)
+  local env_pk=""
+  if [[ -f "${SERVER_DIR}/.env" ]]; then
+    env_pk="$(run_root grep -E '^SERVER_PUBLIC_KEY=' "${SERVER_DIR}/.env" 2>/dev/null | head -1 | cut -d= -f2- | tr -d '[:space:]' || true)"
+  fi
+
   cat <<EOF
 
 ${C_BOLD}Server installed${C_RESET}
   Binary:  ${SERVER_DIR}/peardock-server
-  Config:  ${SERVER_DIR}/.env
+  Config:  ${SERVER_DIR}/.env   ${C_BOLD}← check this file for your keys${C_RESET}
   Service: peardock.service
 
-  Share the server ${C_BOLD}public key${C_RESET} with clients (printed in logs on first start).
-  Never share SERVER_SEED.
+${C_BOLD}Keys (written on first successful start)${C_RESET}
+  After peardock has started once, open the env file:
+
+    sudo grep -E '^(SERVER_PUBLIC_KEY|SERVER_SEED)=' ${SERVER_DIR}/.env
+    # or:  sudo cat ${SERVER_DIR}/.env
+
+  ${C_BOLD}SERVER_PUBLIC_KEY${C_RESET}  64 hex — share with clients (viewer if used alone)
+  ${C_BOLD}SERVER_SEED${C_RESET}         64 hex — ${C_BOLD}admin only${C_RESET}; never share with operators
+
+EOF
+
+  if [[ -n "$env_pk" && ${#env_pk} -eq 64 ]]; then
+    cat <<EOF
+  ${C_GREEN}SERVER_PUBLIC_KEY (from .env):${C_RESET}
+  ${env_pk}
+
+EOF
+  else
+    cat <<EOF
+  If keys are missing, start/restart once then re-check .env:
+    sudo systemctl enable --now peardock
+    sudo systemctl restart peardock
+    sudo grep -E '^(SERVER_PUBLIC_KEY|SERVER_SEED)=' ${SERVER_DIR}/.env
+
+  Journal (also prints the public key on boot):
+    sudo journalctl -u peardock -n 80 --no-pager | grep -i 'public key'
+
+EOF
+  fi
+
+  cat <<EOF
+${C_BOLD}Connect from the desktop client → Add peer${C_RESET}
+  · Public key only              → viewer (read-only)
+  · Public key + SERVER_SEED     → admin
+  · Full pd1.… invite            → role from invite (operators; no seed)
+
+  Operators: as admin open ${C_BOLD}Access → Create invite${C_RESET}, copy the full pd1. string,
+  and share that invite (never SERVER_SEED).
+  Docs: https://peardock.boats/docs/quickstart
 
 EOF
 }
@@ -593,6 +636,14 @@ ${C_BOLD}Client installed (macOS)${C_RESET}
   If Gatekeeper blocks it: right-click → Open, or:
     xattr -cr "$app"
 
+  Connect (Add peer):
+  · Server public key (SERVER_PUBLIC_KEY in the host .env) → viewer
+  · Public key + SERVER_SEED → admin (never share the seed)
+  · Full pd1. invite from an admin → operator without the seed
+
+  On the Docker host:
+    sudo grep -E '^(SERVER_PUBLIC_KEY|SERVER_SEED)=' /opt/peardock/.env
+
 EOF
       else
         warn "peardock.app not found — files are in $client_dir"
@@ -618,7 +669,12 @@ ${C_BOLD}Client installed (Linux)${C_RESET}
   Run:  peardock-client
     or: ${bin}
 
-  Paste the server public key in the sidebar to connect.
+  Connect (Add peer):
+  · Server public key (from /opt/peardock/.env → SERVER_PUBLIC_KEY) → viewer
+  · Public key + SERVER_SEED (same .env; admin only) → admin
+  · Full pd1. invite from an admin → operator/admin without the seed
+
+  On the Docker host:  sudo grep -E '^(SERVER_PUBLIC_KEY|SERVER_SEED)=' /opt/peardock/.env
 
 EOF
       if confirm "Launch peardock-client now?" "n"; then