docs: add README, LICENSE files, and crate/module-level doc comments

Add top-level README.md with alpha status warning, quick start guide,
architecture overview, feature flags, transport modes, auth docs, and
Node.js API examples.

Add dual LICENSE-MIT and LICENSE-APACHE files.

Add comprehensive crate-level and module-level rustdoc to all three
crates (wraith-core, wraith, wraith-napi) and all public modules
(transport, client, server, auth, socks5, error). Add doc comments to
key public types (Transport, TransportAcceptor, ConnectOptions,
ClientSession, Server, ServeOptions, KeySource, ServerAuthConfig, etc).

Update Cargo.toml files with workspace-level package metadata
(version, edition, license, repository) and crate descriptions.

crates/wraith-core/src/client/channel_manager.rs

@@ -1,3 +1,11 @@
+//! Channel manager with automatic reconnection.
+//!
+//! Owns the SSH session handle and provides `open_direct_tcpip()`,
+//! `request_tcpip_forward()`, and `cancel_tcpip_forward()`. Monitors
+//! the session for disconnect and attempts reconnection with exponential
+//! backoff (1s, 2s, 4s, ..., 30s cap). Re-registers remote forwards
+//! after successful reconnection.
+
 use std::collections::HashSet;
 use std::sync::Arc;
 use std::time::Duration;

crates/wraith-core/src/client/connect.rs

@@ -1,3 +1,9 @@
+//! Client session management and connection logic.
+//!
+//! `ClientSession` establishes an SSH connection over a transport, authenticates,
+//! starts a SOCKS5 proxy, sets up port forwards, and monitors for reconnection.
+//! `ConnectOptions` provides a builder-pattern API for programmatic configuration.
+
 use std::net::SocketAddr;
 use std::sync::Arc;
 use std::time::Duration;
@@ -17,6 +23,7 @@ use crate::transport::Transport;
 const DEFAULT_SOCKS5_ADDR: &str = "127.0.0.1:1080";
 const DRAIN_TIMEOUT: Duration = Duration::from_secs(2);
 
+/// Transport mode for the client connection.
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub enum TransportMode {
     Tcp,
@@ -34,6 +41,22 @@ impl std::fmt::Display for TransportMode {
     }
 }
 
+/// Programmatic configuration for a wraith client session.
+///
+/// Construct with `ConnectOptions::new(key_source)` and chain builder methods.
+/// Call `validate()` before passing to `ClientSession::new()`.
+///
+/// ```
+/// use wraith_core::client::{ConnectOptions, TransportMode};
+/// use wraith_core::auth::keys::KeySource;
+///
+/// let opts = ConnectOptions::new(KeySource::File("/path/to/key".into()))
+///     .server("example.com:22")
+///     .transport_mode(TransportMode::Tcp)
+///     .socks5_addr("127.0.0.1:1080")
+///     .forward("5432:db.internal:5432");
+/// opts.validate().unwrap();
+/// ```
 #[derive(Clone)]
 pub struct ConnectOptions {
     pub server: Option<String>,
@@ -155,6 +178,11 @@ impl std::fmt::Debug for ConnectOptions {
     }
 }
 
+/// An active SSH client session over a transport.
+///
+/// Establishes the connection, authenticates, and runs a SOCKS5 proxy plus
+/// port forwards until shutdown or transport failure. On transport failure,
+/// attempts reconnection with exponential backoff (1s, 2s, 4s, ..., 30s cap).
 pub struct ClientSession<T: Transport> {
     opts: ConnectOptions,
     transport: Arc<T>,
@@ -489,6 +517,7 @@ fn build_remote_specs(opts: &ConnectOptions) -> Result<Vec<PortForwardSpec>, Con
     Ok(specs)
 }
 
+/// Errors that can occur during client connection setup and operation.
 #[derive(Debug, thiserror::Error)]
 pub enum ConnectError {
     #[error("connection failed")]

crates/wraith-core/src/client/forward.rs

@@ -1,3 +1,10 @@
+//! Local and remote port forwarding.
+//!
+//! `LocalForwarder` binds a local TCP listener and forwards each connection through
+//! an SSH `direct-tcpip` channel. `RemoteForwarder` requests `tcpip-forward` from
+//! the server and handles `forwarded-tcpip` channels. Specs follow the
+//! `bind_addr:bind_port:target_host:target_port` format.
+
 use std::net::SocketAddr;
 use std::sync::Arc;
 

crates/wraith-core/src/client/mod.rs

@@ -1,3 +1,13 @@
+//! Client-side SSH session management.
+//!
+//! Provides `ClientSession` for establishing an SSH connection over any transport,
+//! running a local SOCKS5 proxy, and managing port forwards. Also provides
+//! `ChannelManager` for programmatic channel management with automatic reconnection.
+//!
+//! The client always starts a SOCKS5 proxy (default `127.0.0.1:1080`) when running
+//! via `ClientSession::run()`. For VPN-like "route all traffic" behavior, use
+//! [tun2proxy](https://github.com/tun2proxy/tun2proxy) alongside the SOCKS5 proxy.
+
 pub mod channel_manager;
 pub mod connect;
 pub mod forward;