feat: add Direct WSS provisioning

README.md

@@ -227,9 +227,14 @@ Direct mode does not use SSH. It requires Imp's authenticated gateway behind a
 publicly trusted TLS reverse proxy plus a pairing token.
 
 Direct WSS is deliberately not enabled by the normal server installation.
-
-See [VPS deployment](deploy/README.md#direct-wss-gateway-advancedmanual) for
-gateway, TLS, and pairing setup.
+Provision pairing with the installed bundle's
+[`imp-direct-wss`](deploy/README.md#direct-wss-gateway-advanced) `setup`,
+`rotate`, and `status` commands. The command prints a token only for deliberate
+one-time terminal handoff; never capture or redirect that output.
+
+See [VPS deployment](deploy/README.md#direct-wss-gateway-advanced) for the
+supported service boundary, TLS/proxy operator responsibilities, bounded
+public verification, and separately authorized live acceptance plan.
 
 ## What Imp provides
 

apps/desktop/src/components/ConnectionDialog.svelte

@@ -208,10 +208,18 @@
             />
           </label>
 
+          <p class="mode-help">
+            Obtain a token with <code>imp-direct-wss setup</code> on the server. Enter the public WSS URL and token
+            separately; never append the token to the URL.
+          </p>
+
           <p class="mode-help">
             {settings.hasPairingToken
               ? 'Leave the token blank to keep the currently stored credential.'
-              : 'Paste the 43-character pairing token supplied by the gateway operator.'}
+              : 'Paste the 43-character pairing token from the server setup command.'}
+          </p>
+          <p class="mode-help">
+            After server rotation, paste the replacement token. Save and restart Imp to use it.
           </p>
         {/if}