feature: vre opens files from the Router Manager's shell in the editor of its Shell page.

README.md

@@ -1099,6 +1099,34 @@ off or the TOTP enrolment removed; the router then sends a close frame with the
 journal of `vpn-router-web` records who opened each shell, from which address, in which unit,
 when it ended and why, and each refused ticket or shell with the reason.
 
+#### The editor of the shell
+
+In the shell, `vpn-router-editor FILE...`, or its short name `vre`, opens files in the editor of
+the Router Manager's Shell page and returns at once:
+
+```sh
+vre /etc/vpn-router/vpn-router.json ~/notes.txt
+```
+
+- **How the files reach the page:** each shell has its session in `VPN_ROUTER_SHELL`. `vre`
+  names each file, as an absolute path, with that session on the socket
+  `/run/vpn-router/editor.sock`. The web service accepts it only from a process that runs as the
+  shell's console account, and sends the page a text message `{"editor": "open", "session", "id", "path"}`
+  over the shell's WebSocket.
+- **Reading and saving:** the page uses the routes below, which need the user's access token. The
+  file is read and written as the console account by `/usr/lib/vpn-router/editor-file`, run with
+  `systemd-run --uid --pipe`, so the account's permissions apply. A save writes the file in place,
+  keeping its owner and mode, and creates a file that does not exist.
+- **Limits:** only regular files of UTF-8 text up to 1 MiB, and at most 20 open files per shell.
+- **Lifetime:** the files are open while the shell lives. `vre` outside the Router Manager's shell
+  exits with status 2.
+
+| Request | Body | Answer |
+| --- | --- | --- |
+| `GET /shell/editor/<session>/<id>` | | `{"path", "content", "version"}`, `version` the SHA-256 of the content |
+| `PUT /shell/editor/<session>/<id>` | `{"content", "version"}` | `{"path", "version"}`; 409 when the file no longer has `version` |
+| `DELETE /shell/editor/<session>/<id>` | | `{"path", "closed": true}` |
+
 ### The /config page
 
 `/config` shows what `/` and `/status` leave out, for a client such as manage-ui: