Add a documentation website, built with Zola

The documentation moves from READMEs into a site in docs/: getting
started, a user guide, operations, a reference, and development pages,
written in the style of network vendors' documentation (docs/STYLE.md).
bin/bgp/README.md and docs/RFCs.md are folded into it.

- A theme of its own in the International Typographic Style, in blues,
  with self-hosted Inter and JetBrains Mono, search over Zola's index,
  dark mode, and no resources loaded from other hosts.
- Example configurations in docs/examples/, shown on the pages and
  checked with `bgp --check` in CI.
- A test that fails when a field of config.proto is missing from the
  configuration reference.
- A CI job that builds the site; Zola fails on broken links and anchors.
- A hardened systemd unit, tried under systemd with kernel routes on.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

README.md

@@ -6,20 +6,16 @@ The aim of this project is to provide a modern, high performance, secure, progra
 
 ## Current status
 
-The daemon holds sessions with configured peers, takes their routes through an import policy, validates them against the RPKI (route origin validation and ASPA), picks the best route for each prefix and, on Linux, installs it in the kernel. It announces the routes it originates and, to the peers configured for it, the best of what it learned from the others, as far as RFC 9234's roles and the routes' communities allow.
+The daemon establishes BGP sessions with configured neighbors, evaluates received routes against import policy, validates them with the RPKI (route origin validation and ASPA), selects the best path for each prefix, and, on Linux, installs it in the kernel. It advertises the routes that it originates and, to neighbors configured for it, the best paths learned from other neighbors, as BGP roles (RFC 9234) and communities permit.
 
-- [`bin/bgp/README.md`](bin/bgp/README.md): what the daemon does, how to configure and run it, and how it is tested against FRR, BIRD and Routinator.
-- [`docs/RFCs.md`](docs/RFCs.md): which parts of which RFCs are implemented.
-- [`crates/server/proto/config.proto`](crates/server/proto/config.proto): the configuration, field by field.
+Ferrix has not been deployed in a production network.
 
-It has not yet run in a production network.
+### Unsupported Features
 
-### Not there yet
-
-- Route reflection, per-client selection for a route server, ADD-PATH for learned routes
-- TCP-AO / TCP MD5 and GTSM
-- Graceful restart, BFD, changing the configuration without a restart
-- Next hops that are not directly connected
+- Route reflection, per-client best path selection for route servers, and ADD-PATH for advertised routes
+- TCP-AO, TCP MD5, and GTSM
+- Graceful restart, BFD, and configuration changes without a restart
+- Recursive resolution of next hops that are not directly connected
 
 ### Layout
 
@@ -34,6 +30,33 @@ It has not yet run in a production network.
 | `crates/web` | The status page, HTTP API and metrics |
 | `bin/bgp` | The daemon |
 
+## Documentation
+
+The documentation is a website built from [`docs/`](docs/) with
+[Zola](https://www.getzola.org):
+
+```
+zola --root docs serve     # http://127.0.0.1:1111
+```
+
+- [Overview](docs/content/docs/getting-started/introduction.md) and
+  [quick start](docs/content/docs/getting-started/quick-start.md)
+- User guide: [BGP neighbors](docs/content/docs/guides/peers.md),
+  [import policy](docs/content/docs/guides/import-policy.md),
+  [BGP roles](docs/content/docs/guides/roles.md),
+  [RPKI](docs/content/docs/guides/rpki.md),
+  [kernel route installation](docs/content/docs/guides/kernel.md),
+  [route advertisement](docs/content/docs/guides/passing-routes-on.md),
+  [configuration examples](docs/examples/)
+- [Deployment](docs/content/docs/operations/deployment.md) and
+  [monitoring](docs/content/docs/operations/monitoring.md)
+- Reference: [configuration](docs/content/docs/reference/configuration.md),
+  [HTTP API](docs/content/docs/reference/http-api.md),
+  [metrics](docs/content/docs/reference/metrics.md),
+  [supported standards](docs/content/docs/reference/rfcs.md)
+- [Architecture](docs/content/docs/development/architecture.md) and
+  [testing](docs/content/docs/development/testing.md)
+
 ## Development
 
 CI runs these on every push, and fails on any warning:
@@ -43,6 +66,7 @@ cargo fmt --all -- --check
 cargo clippy --workspace --all-targets -- -D warnings
 cargo test --workspace
 RUSTDOCFLAGS="-D warnings" cargo doc --workspace --no-deps --document-private-items
+zola --root docs build
 ```
 
 It also runs the tests that need a real Linux kernel