feat(clients): add client details and secure config export

PLANS.md

@@ -265,7 +265,7 @@ Allowed status values: `NOT STARTED`, `IN PROGRESS`, `BLOCKED`, `DONE`.
 | M2        | DONE        | WireGuard parser, client model, `status`, and `list` |
 | M3        | DONE        | Locking, backups, atomic apply, and rollback engine  |
 | M4        | DONE        | Safe client creation                                 |
-| M5        | NOT STARTED | Client detail, config export, and QR display         |
+| M5        | DONE        | Client detail, config export, and QR display         |
 | M6        | NOT STARTED | Safe client removal and archival                     |
 | M7        | NOT STARTED | Diagnostics engine and report                        |
 | M8        | NOT STARTED | Backup listing/restoration and audit log UX          |
@@ -1621,6 +1621,20 @@ Use this template:
 - Suggested commit message: `feat(clients): add transactional client creation`
 - Next milestone: M5
 
+## 2026-10-13 — M5 — DONE
+
+- Implemented: non-secret `show NAME` client details; validated path-only `config NAME` output with explicit `--show` full-config export; stdin-only `qrencode -t ansiutf8` integration with a clear missing-dependency fallback; exact managed identity checks; and config, metadata, ownership, mode, hardlink, symlink, and open-time identity validation.
+- Coordinator: `gpt-5.6-sol` (`high`)
+- Subagents: `milestone_worker` / `milestone_repairer`, `gpt-5.6-luna` (`medium`)
+- Repair cycles: 5
+- Sol review: restored the full M0–M4 regression dispatch; fixed failure-status capture and caller `errexit` preservation; required persistent-disk identity for managed association; added open-time file-identity verification and actionable `stat` diagnostics; strengthened missing-client, unmanaged, ambiguous, mismatched, runtime-only, CLI, QR, path, permission, ownership, hardlink, symlink, and secret-safety tests; and removed a misleading unused fixture.
+- Verification: `bash -n wg-manager.sh`, `bash -n tests/run.sh`, `bash -n tests/mocks/bin/qrencode`, `bash tests/run.sh show-client`, `bash tests/run.sh config-export`, `bash tests/run.sh qr`, `bash tests/run.sh path-safety`, `bash tests/run.sh no-secret-default-output`, `bash tests/run.sh`, `bash tests/run.sh no-secret-logs`, `git diff --check`, permission, scope, and secret-pattern review.
+- Result: all required checks passed; show-client/config-export/qr/path-safety/no-secret-default-output/no-secret-logs suites passed 44/16/13/31/45/41 assertions, and the full regression suite passed 399 assertions. Optional `shellcheck wg-manager.sh tests/*.sh tests/mocks/bin/*` was `SKIP` because ShellCheck is unavailable.
+- Decisions: none
+- Known limitations: real WireGuard, `/etc/wireguard`, networking, systemd, firewall, routes, sysctl, journal, and deployment-server behavior were not accessed or tested; M5 verification is fixture- and mock-based as required. Full config output is deliberately available only through the explicit noninteractive `config NAME --show` action.
+- Suggested commit message: `feat(clients): add client details and secure config export`
+- Next milestone: M6
+
 # 8. Final completion rule
 
 The MVP is complete only when: