feature: the package installs the Router Manager, which is no longer a package of its own.

docs/users.md

@@ -0,0 +1,34 @@
+# Users
+
+The users of the router's directory, without the [service accounts](service-accounts.md).
+
+## Kinds of users
+
+- **VPN user:** a first name, a last name, an e-mail address and a certificate; signs in to
+  OpenVPN, IKEv2 and WireGuard, and to the Manager.
+- **Manager-only account:** a name, a password and an optional e-mail address; no certificate and
+  no VPN access.
+
+## Columns
+
+- **OTP:** whether the user is enrolled for one-time passwords (TOTP).
+- **Passkeys:** how many passkeys the user signs in to the Manager with.
+- **Console:** for a member of `admins`, the console login: off, the user's own POSIX account with
+  its uid, or the local account it runs as; marked as refused while the user is not enrolled for
+  TOTP. Root switches it on the router with `vpn-router-user console`.
+
+## Actions
+
+- **Add:** a VPN user, or with Manager access only a Manager-only account.
+- **Edit:** the names and the e-mail address of a VPN user, the e-mail address of a Manager-only
+  account.
+- **Password**, **Disable**, **Enable**, **Unlock** after failed logins, and **Remove**.
+- **Profile:** downloads the OpenVPN client profile, while the router runs OpenVPN.
+- **Apple VPN profile** (Apple icon): downloads a `.mobileconfig` that sets up the router's IKEv2
+  VPN on a Mac, iPhone or iPad, while the router runs IKEv2. The password you type protects the
+  user's key in the profile; the device asks for it when the profile is installed.
+- **OTP:** enrols an authenticator app with a QR code, stored once a code of the app is entered,
+  or removes the enrolment.
+- **Remove passkeys:** removes all the user's passkeys.
+
+Five wrong passwords lock a user for 15 minutes; Unlock ends that sooner.