[dmytrogajewski]

Readers can browse a prrr-branded documentation site, follow a complete client connection, and inspect the actual handshake, encrypted packet path, and routing/recovery through detailed animated diagrams.

• Add 14 canonical guides using the existing black/white/gold cat/key identity. Update the live README and repository website link; preserve historical flat prose outside the published navigation.
• Add 22 illustrated SVG chapters covering Noise IK + ML-KEM setup, authenticated packet fields and transport framing, round-trip forwarding/replay rejection, and routing/DNS/watchdog recovery. Include directional moving envelopes, chapter seeking, speed controls, keyboard access, portrait reflow, reduced motion, print output, and complete text transcripts.
• Pin source observations to revision 191ebaf, after built-in messaging removal. Explain differing transport defaults, actual HKDF-SHA256 derivation, certificate verification, the HTTP admin boundary, and host-egress recovery without overstating anonymity or a kill switch.
• Build and validate the site in CI, exercise real isolated CLI provisioning/import/export/revocation/route workflows, and deploy checked output from main to GitHub Pages.
• In a separate commit, update only the locked rustls version from 0.23.45 to 0.23.46 to resolve the four advisories blocking the existing audit gate. No protocol/application logic changes.

Validation: make lint clean; make test: 1,006 passed, 29 ignored; actionlint and Python syntax clean; six TOML fences and 17 CLI help surfaces plus isolated real workflows pass. Full Chromium suite covers 15 HTML pages/local links, all 22 chapters, semantic payloads, actor containment, real packet movement/pause/final delivery, keyboard focus, speed, reduced motion, local-only assets/search, no-JavaScript transcripts, print, and 375/820px layouts. Actual desktop/mobile screenshots were inspected.

Audit files, private credentials, and the ignored local specification workspace are excluded. No running VPN services, routes, or host network configuration were changed.