docs: align documentation with nx9-wg implementation

docs/cli.md

@@ -30,6 +30,9 @@ nx9-wg version --format json
 ### 2. `serve`
 Starts the Axum REST API, WebSocket event streamer, and background reconciliation daemon.
 ```bash
+nx9-wg serve
+
+# To intentionally expose the management API on all interfaces:
 nx9-wg serve --bind 0.0.0.0:8080
 ```
 
@@ -62,7 +65,7 @@ nx9-wg init --password-file /run/secrets/admin_pw
 - `nx9-wg admin sessions list`: List active sessions.
 - `nx9-wg admin sessions revoke <SESSION_ID>`: Invalidate specific session.
 - `nx9-wg admin sessions revoke-all`: Invalidate all active administrator sessions.
-- `nx9-wg admin tokens create --name <NAME> [--days <DAYS>]`: Generate a long-lived API token.
+- `nx9-wg admin tokens create --name <NAME> [--days <DAYS>] [--write-token-file <PATH>]`: Generate a long-lived API token. The recommended secure workflow writes the one-time plaintext token to a file with restrictive permissions; token hashes are redacted from normal CLI output.
 - `nx9-wg admin tokens list`: List all API token metadata.
 - `nx9-wg admin tokens revoke <TOKEN_ID>`: Revoke an API token.