Add server configuration editing with byte preservation

README.md

@@ -1,8 +1,10 @@
 # wireguard-admin
 
-This repository now contains the initial Rust package, startup boundary, and
-validated settings loader for WireGuard Admin. Client management and the VPN
-management interface have not been implemented yet.
+This repository contains the initial Rust package, startup boundary, validated
+settings loader, client domain model, and a pure in-memory WireGuard server
+configuration parser/editor. The terminal management interface, file
+persistence, vault, client import workflow, backups, and VPN operations have not
+been implemented yet.
 
 The package requires Rust 1.97.1 or newer and uses the Rust 2024 edition. From
 the repository root, run:
@@ -41,3 +43,29 @@ absolute. Settings validation checks syntax and values only; it does not
 require the referenced files, directories, or service to exist and does not
 perform DNS lookups.
 
+## Library configuration API
+
+The library exposes `wireguard_admin::wireguard::ConfigDocument` for UTF-8
+configuration bytes supplied by the caller. It retains the source and renders
+unmodified input byte-for-byte, including line endings and a missing final
+newline. Peer inspection exposes public identities, parsed `AllowedIPs`, spans,
+and redacted issues; arbitrary directive values are not included in the view.
+The edit methods `add_client`, `delete_client`, `rename_client`, and
+`insert_legacy_metadata` return new in-memory documents. They do not read or
+write files, save changes, or alter the running VPN. See
+[`docs/CONFIG_FORMAT.md`](docs/CONFIG_FORMAT.md) for the managed metadata block
+format.
+
+Example:
+
+```rust,ignore
+use wireguard_admin::wireguard::ConfigDocument;
+
+let document = ConfigDocument::parse(config_bytes)?;
+let updated = document.rename_client(&public_key, "office laptop")?;
+let bytes_to_review = updated.render(); // no persistence or VPN operation
+```
+
+Management startup still exits with an explicit “not implemented” error after
+its root check; the library APIs are not yet connected to a management session.
+