feature: vpn-config-edit set and remove take --restart, which applies the change with vpn-router-setup and waits for it.

README.md

@@ -343,6 +343,7 @@ vpn-config-edit set web.port 7082
 vpn-config-edit set web.trusted_proxies 127.0.0.1,10.0.0.4
 vpn-config-edit set site_to_site.branch.addrs branch.example.net
 vpn-config-edit remove site_to_site.branch
+vpn-config-edit set --restart oidc.enabled true
 ```
 
 `show` prints the file as indented JSON and does not change it. `set` takes a setting as
@@ -351,7 +352,9 @@ creates with the defaults when it does not exist, and converts the value to the
 a whole number, `true` or `false`, a list separated by commas (an empty value is an empty list),
 or a string; an unknown setting is refused. `remove site_to_site.NAME` removes a connection. It
 checks the whole configuration as `vpn-router-setup` does, and only then writes the file,
-indented, with mode 0600, and reminds that `vpn-router-setup` applies it. The status web service
+indented, with mode 0600, and reminds that `vpn-router-setup` applies it; with `--restart`, `set`
+and `remove` restart `vpn-router-setup` and wait until it has applied the change, and exit with
+status 1 when it fails. The status web service
 writes the file the same way, and a lock keeps the two from overwriting each other's change. A
 refused request exits with status 2, any other failure with 1.
 
@@ -1339,8 +1342,7 @@ answers it only on `127.0.0.1`, where Caddy passes the requests, so the provider
 over plain HTTP. The setting needs `web.enabled`, `https.enabled` and `wan.local_fqdn`.
 
 ```sh
-vpn-config-edit set oidc.enabled true
-systemctl restart vpn-router-setup
+vpn-config-edit set --restart oidc.enabled true
 curl https://router.example.com:7444/.well-known/openid-configuration
 ```