checkpoint: integrate authenticated transports

docs/TROUBLESHOOTING.md

@@ -8,15 +8,16 @@ Check the simplest layer that can explain the symptom, then move outward.
   error.
 - Check that every secret/certificate path exists and is readable by the
   service account, but not by unrelated users.
-- Run `wgcloak --help` and, where implemented, `wgcloak check-config` to spot a
-  command or schema mismatch.
+- Run `wgcloak --help` and `wgcloak check-config` to spot a command or schema
+  mismatch.
 - Confirm listener addresses are valid and no other process owns the port.
 
 ## Client cannot connect
 
 - Verify DNS resolution and the configured server name/port.
-- Confirm the selected transport is implemented in this build; an `auto` list
-  may mention future transports.
+- Confirm the selected server listener is enabled and that the matching
+  transport/port appears in its `status` output. In auto mode, check the
+  configured client order and `retry_ms` status while it probes.
 - For direct UDP, check both directions in the host firewall and allow the
   server's UDP listener.
 - For TLS transports, verify the hostname matches the certificate and do not
@@ -44,17 +45,22 @@ fallback probing rather than generate traffic across every transport.
 
 ## Session disappears
 
-The target idle timeout is 120 seconds, refreshed by authenticated data or
-keepalive. Check keepalive settings, NAT expiry, server resource limits, and
-whether the client is reconnecting after a transport failure. A valid direct
-UDP packet can update the peer address after NAT rebinding; a spoofed packet
-without a valid MAC cannot.
+The server's configured idle timeout applies per session. Check transport
+keepalive behavior, NAT expiry, server resource limits, and whether the client
+is reconnecting after a transport failure. A valid direct UDP packet can
+update the peer address after NAT rebinding; a spoofed packet without a valid
+MAC cannot.
 
 ## Control socket unavailable
 
-Check the daemon's `XDG_RUNTIME_DIR`, socket ownership/mode, and whether a
-stale socket path remains after an unclean exit. The control interface is local
-only and may be absent until the operational-polish milestone is implemented.
+Check the daemon and CLI use the same `XDG_RUNTIME_DIR`, and verify the
+directory is private and the socket mode is `0600`. If `XDG_RUNTIME_DIR` is
+unset or is not current-user-owned mode `0700`, the daemon uses
+`/run/user/<uid>/wgcloak/` when available, or `$HOME/.local/run/wgcloak/`.
+An active socket is never removed; a stale socket can be replaced only after
+its type and identity are checked.
+The `reload` command is present but currently returns an unsupported response;
+neither configuration nor certificate hot reload is implemented.
 
 ## Host hardening prevents startup