feature: the package installs the Router Manager, which is no longer a package of its own.

docs/groups.md

@@ -0,0 +1,18 @@
+# Groups
+
+The groups of the router's directory, with their descriptions and members.
+
+- **Add** and **Edit:** the name, the description and the members in one dialog. A group has at
+  least one member: a user or a service account, but not an internal one.
+- **Remove:** removes the group; its members are kept, and it is taken out of the roles assigned
+  to it. A group that a client of the [OpenID Provider](service-accounts.md#openid-provider) allows
+  cannot be removed.
+
+## Groups the router reads
+
+- **admins:** its members use all pages of the Manager. Only root on the router changes it, with
+  `vpn-router-group` or a token of `vpn-router-token`.
+- **Allowed groups** of an OpenID Connect client: only their members may sign in to that client.
+  Renaming a group renames it in those clients.
+- **Roles** of a resource of the OpenID Provider assigned to a group are roles of its members, in
+  the tokens for that resource. Renaming a group renames it in those roles.