Say what the code actually does, in the three places that had drifted

A doc comment is not compiled, so nothing catches one that has outlived
what it described. `cargo doc` does catch a subset, and it was failing:
three unresolved intra-doc links in config.rs, all mine from today -- two
naming `parse`/`render` from outside the module that defines them, and one
`format` that is ambiguous with the macro. Rustdoc now runs clean with
broken_intra_doc_links denied.

auth.rs's module doc pointed at a test called `token_is_never_logged`,
which no longer exists: it was folded into the combined gating+logging test
because tracing caches callsite interest process-wide. The doc now
describes the test that is there and says why it is one test.

AGENTS.md contradicted itself twice, both checked against a running server
rather than by reading. Its curl example passed `--cacert certs/ca.pem`, a
path relative to the checkout, while the bullet above it correctly says the
CA is generated under $XDG_CONFIG_HOME -- so the documented command fails
before it connects; with the real path it returns `[]`. And it said wg0
"doesn't exist on this machine yet" as the reason for --bind 127.0.0.1,
which the section below it already contradicts: wg0 is up at 10.66.0.1, and
the actual reason is that the emulator dials 10.0.2.2 and cannot reach it.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017xn8nHw1tw1R6PtiY1eEtw

server/src/auth.rs

@@ -9,8 +9,9 @@
 //! defense in depth rather than the sole gate.
 //!
 //! Nothing in this module -- and nothing anywhere else -- may log the
-//! Authorization header or the token; `token_is_never_logged` below holds a
-//! tripwire against a logging change silently starting to.
+//! Authorization header or the token; the test below holds a tripwire
+//! against a logging change silently starting to. It is one test covering
+//! both gating and logging on purpose -- see the note in it.
 
 use std::net::SocketAddr;
 use std::sync::Arc;

server/src/config.rs

@@ -7,7 +7,7 @@
 //! funnels through `SessionManager` (the registry pattern), so in-memory
 //! and on-disk state can't come apart.
 //!
-//! The file is RON, in the shape the [`format`] module describes -- the
+//! The file is RON, in the shape the [`mod@format`] module describes -- the
 //! same format, and the same two house rules, as the sibling dev-updater
 //! project's config, because both are written and read by hand.
 //!
@@ -30,9 +30,10 @@ use crate::private;
 ///
 /// **No outer parentheses.** A file *is* the body of the struct, so nothing
 /// in it is indented for the sake of a wrapper. RON has no implicit
-/// top-level struct (`de/mod.rs` requires the `(`), so [`parse`] adds it
-/// and [`render`] takes it back off. The opening paren is not followed by a
-/// newline, so a parse error's line number still points at the real line.
+/// top-level struct (`de/mod.rs` requires the `(`), so [`format::parse`]
+/// adds it and [`format::render`] takes it back off. The opening paren is
+/// not followed by a newline, so a parse error's line number still points
+/// at the real line.
 ///
 /// **`Some` is implicit.** Enabled on the deserializer rather than by a
 /// `#![enable(implicit_some)]` header the file would have to carry, and