[P6] Docs and examples for all three client paths

[jacaudi]

Context

examples/ currently covers the original single-server use case: server.yaml, peer.yaml, serverWithIpForwardEnable.yaml, serverWithNodePortService.yaml. None of the gateway functionality is represented.

Scope

Worked examples and docs for:

• the three client paths — ClusterIP for in-cluster pods, LoadBalancer for mobile and stock clients, Gateway plus wstunnel for obfuscated desktop clients — with the mobile limitation stated explicitly (PreUp and friends are unsupported on iOS and Android)
• gluetun setup, including credentials by secretRef and the firewall implications
• the implicit client flow: label a Deployment, get a tunnelled pod
• cross-namespace attachment and the consent model
• the killswitch layers and what each protects against

Acceptance criteria

• An example per client path
• gluetun example end to end
• Implicit client example
• README.md features list updated

See docs/ROADMAP.md § Phase 6.1.