feat(clients): add client details and secure config export

README.md

@@ -60,3 +60,27 @@ permissions and are removed if the server transaction or rollback fails.
 Generated key material is supplied to `wg` through stdin or stdout and is not
 placed in command arguments or diagnostic output.
 
+## M5 inspection and export
+
+`show NAME` displays only non-secret peer details and a config path after
+identity, ownership, mode, and path validation. `config NAME` prints only that
+validated path. Full client content requires the explicit noninteractive
+`config NAME --show` form; it never reads separate `.key` or `.psk` files.
+
+`qr NAME` feeds the validated config to `qrencode -t ansiutf8` through stdin.
+If the optional `qrencode` dependency is unavailable, it prints the safe config
+path and returns status `69`; QR failures return the operation status. Routine
+show/export/path/error output is secret-free.
+
+The inspection commands do not require `gum` or `qrencode` for `show` and
+`config`. `qrencode` is the only optional QR dependency; when it is absent,
+`qr NAME` writes the validated configuration path to stdout and an actionable
+warning to stderr, then returns status `69`. A nonzero `qrencode` result
+returns status `70` without printing configuration content in the diagnostic.
+
+Common command statuses are `64` for usage errors, `65` for invalid or unsafe
+client identity/path data, `69` for a missing optional dependency, and `70`
+for an operational read/export/QR failure. `config NAME --show` is the only
+inspection form that writes the complete client configuration to stdout;
+ordinary `show`, `config`, and `qr` output remains secret-safe.
+