fix: the router's IPsec remote access is called IKEv2 instead of road-warrior.

ADR.md

@@ -46,7 +46,7 @@ and as a Tailwind CSS page for a browser, and `/status` is the same status as JS
 much as `web.status_content` says, since the router is reachable from the internet and the
 operator decides how much it tells strangers: `basic`, the default because it tells the least,
 the overall status and the Client IP, `standard` also the package versions and the number of
-active and other services, and `full` also each service and the state of the site-to-site, road-warrior, OpenVPN and
+active and other services, and `full` also each service and the state of the site-to-site, IKEv2, OpenVPN and
 WireGuard features. The Client IP is the address the request came from, through the trusted
 proxies, so a person can see the address the router sees. Nothing comes from the configuration.
 `/status` names its content, so clients such as manage-ui and the Router Manager show what it
@@ -458,7 +458,7 @@ refresh tokens after the operations of `vpnrouter_auth.REVOKING`.
 
 Consequences: A Manager-only account cannot become a VPN user, as LDAP cannot change an entry's
 structural class and its password hash cannot be copied; it is removed and added again instead.
-It has no certificate, so OpenVPN and road-warrior access refuse it. The administrator's password
+It has no certificate, so OpenVPN and IKEv2 access refuse it. The administrator's password
 is on disk only until setup has run.
 
 ## ADR-19: The package has an LDAP schema of its own under a UUID OID
@@ -655,8 +655,8 @@ one, so its name is the one the tunnel always had.
 - **Local settings per connection:** each connection has its own `local_cidrs` and
   `local_id_mode`, as each peer expects its own traffic selectors and identity. `wan.local_fqdn`
   stays the router's one name, used by the `fqdn` mode, resolved once for the `public_ip` mode,
-  and used by HTTPS, road-warrior and OpenVPN. `local.cidrs` stays the subnets the router
-  routes, masquerades and offers to road-warrior and OpenVPN clients.
+  and used by HTTPS, IKEv2 and OpenVPN. `local.cidrs` stays the subnets the router
+  routes, masquerades and offers to IKEv2 and OpenVPN clients.
 - **One file:** `vpn-router-setup` writes every connection that is ready to
   `/etc/swanctl/conf.d/site-to-site.conf`, with the proposals and timers the one tunnel had, and
   removes the file when none is. The NAT exemptions pair each connection's `local_cidrs` with its
@@ -766,9 +766,9 @@ signs the requester's CSR, or makes the key and returns it once in a PKCS#12 fil
 the certificate, so a key it gave away cannot leak from it later. The PKCS#12 file uses 3DES and
 SHA-1 MACs, the encryption the key stores of Windows and macOS import. strongSwan reads only the
 first certificate of a PEM file, so each CA has a file of its own in `/etc/swanctl/x509ca`;
-road-warrior and site-to-site name their CA in `cacerts`, which restricts the trust chain to it.
+IKEv2 access and site-to-site name their CA in `cacerts`, which restricts the trust chain to it.
 
-Consequences: The P2S CA's certificates are accepted by road-warrior and OpenVPN only, the site-to-site CA's by
+Consequences: The P2S CA's certificates are accepted by IKEv2 and OpenVPN only, the site-to-site CA's by
 site-to-site only. With an offline root, new issuing CAs and the root CRL need the offline step,
 and a router whose P2S CA waits has no VPN server certificate and so no P2S access. The router
 keeps the users' keys, as the OpenVPN profile embeds them.
@@ -1198,7 +1198,7 @@ resolver share no address.
 
 Status: Accepted
 
-Context: macOS, iOS and iPadOS connect to the road-warrior access with their built-in IKEv2 client,
+Context: macOS, iOS and iPadOS connect to the IKEv2 access with their built-in IKEv2 client,
 configured by a configuration profile. The router keeps each user's certificate and key. Apple's
 clients read a PKCS#12 only when it is encrypted with 3DES and SHA-1, send one proposal per SA,
 and show an unsigned profile as unverified.
@@ -1213,18 +1213,18 @@ Consequences: The password is never stored; the device asks for it when the prof
 A profile shows as unverified. A changed proposal of `road-warrior.conf` must be changed in the
 profile too. WireGuard is not part of it.
 
-## ADR-45: Road-warrior clients get split DNS domains, p2s.dns_domains
+## ADR-45: IKEv2 clients get split DNS domains, p2s.dns_domains
 
 Status: Accepted
 
-Context: The road-warrior access is a split tunnel. macOS and iOS use the DNS server an IKEv2 VPN
+Context: The IKEv2 access is a split tunnel. macOS and iOS use the DNS server an IKEv2 VPN
 pushes only for queries scoped to the tunnel, so names only the router resolves, such as Azure's
 internal names, fail. RFC 8598 defines INTERNAL_DNS_DOMAIN (attribute 25): the client resolves the
 listed domains and their subdomains with the VPN's servers. strongSwan's pools take numeric
 attributes with string values; Apple profiles name such domains in `SupplementalMatchDomains`.
 
 Decision: The setting `p2s.dns_domains` lists the domains; setup pushes each as attribute 25 of the
-road-warrior pool, and the Apple VPN profile gives them as match domains of the router's resolver,
+IKEv2 address pool, and the Apple VPN profile gives them as match domains of the router's resolver,
 the addresses setup records for the web service.
 
 Consequences: Clients resolve the listed domains through the tunnel and everything else with their