chore: docs, plans archive, script updates, submodule refs

AGENTS.md

@@ -18,6 +18,9 @@ NexusGuard SD-WAN Suite — Enterprise Zero-Trust SD-WAN with WireGuard tunnelin
 ├── docker-compose.dev.yml  # Dev (air hot-reload)
 ├── Makefile            # up/down/dev/migrate/reset-db
 ├── setup.sh            # First-run: generate .env + random keys
+├── update.sh           # Docker update: pull/build/migrate
+├── nexusguard-install.sh   # Native install (systemd + nginx)
+├── nexusguard-uninstall.sh # Native uninstall
 ├── .env.example        # DB/JWT/SALT/VITE config template
 ├── .gitmodules         # 3 submodules → git.datadunia.com
 └── .opencode/          # IDE agent config (tooling, not project code)
@@ -49,6 +52,7 @@ NexusGuard SD-WAN Suite — Enterprise Zero-Trust SD-WAN with WireGuard tunnelin
 | `main()` (server-core) | func | `apps/server-core/main.go` | Entry: CLI flags + Gin init |
 | `main()` (device-agent) | func | `apps/device-agent/main.go` | Entry: agent daemon lifecycle |
 | `config.Load()` | func | `apps/server-core/internal/config/` | Env-based config loader |
+| `config.LoadConfFile()` | func | `apps/server-core/internal/config/config_loader.go` | Config file parser (.env / nexusguard.conf) |
 | `auth.Init()` | func | `apps/server-core/internal/auth/` | JWT sign/verify init |
 | `firewall.InitNetwork()` | func | `apps/server-core/internal/firewall/` | nftables table/set creation |
 | `ipam.AllocateIP()` | func | `apps/server-core/internal/ipam/` | IP pool allocation from CIDR |
@@ -68,6 +72,7 @@ NexusGuard SD-WAN Suite — Enterprise Zero-Trust SD-WAN with WireGuard tunnelin
 - **Build tags**: `//go:build dev` for AutoMigrate
 - **Capabilities**: Server containers need `NET_ADMIN` + `NET_RAW`
 - **Ports**: API 8080, Dashboard 80 (Nginx), Postgres 5432, Redis 6379
+- **Config**: Docker uses `.env`, native uses `/etc/nexusguard/nexusguard.conf`
 
 ## ANTI-PATTERNS (THIS PROJECT)
 - **NEVER** `nft flush table` — only atomic add/remove
@@ -86,6 +91,7 @@ NexusGuard SD-WAN Suite — Enterprise Zero-Trust SD-WAN with WireGuard tunnelin
 
 ## COMMANDS
 ```bash
+# Docker
 make up              # Start all services
 make down            # Stop all services
 make dev             # Start with hot-reload (air)
@@ -93,11 +99,22 @@ make logs            # Tail all logs
 make migrate         # Run DB migration (requires local Go)
 make reset-db        # Nuke PG volume + recreate + migrate
 
+bash update.sh       # Smart update (rebuild only if changes)
+bash update.sh --force  # Force rebuild
+
+# Native Install
+sudo bash nexusguard-install.sh
+sudo bash nexusguard-uninstall.sh
+sudo bash nexusguard-uninstall.sh --remove-db
+
+# Development
 cd apps/server-core && go run -tags dev .
 cd apps/dashboard-ui && npm run dev
 cd apps/device-agent && go run .
 
+# Admin
 go run -tags dev ./apps/server-core -create-admin -user admin -pass "..."
+sudo /usr/local/bin/nexusguard-server -create-admin -user admin -pass "..."
 ```
 
 ## NOTES