Onboarding wizard and MA signup/enroll site

DEPLOY.md

@@ -16,6 +16,27 @@ frxd serve
 
 The node connects outbound over HTTPS, verifies the registry with the pinned MA key, and holds an SSE stream per relay. Nothing inbound, no DNS, no certificates. Members at departmental level can start here.
 
+## Joining the network (membership site + wizard)
+
+Identity registration stays with the MA; the wizard only consumes the credentials it issues.
+
+MA operator — run the signup site:
+
+```
+frxd registry --dir ./ma init --zone frx.example
+frxd registry --dir ./ma serve --listen 127.0.0.1:7800 --signup-code <code> --registry-url https://ma.example.com/registry.json
+```
+
+(put Caddy in front for a real domain). The page at `/` accepts a label and the signup code and returns a credential block: `id=... token=... registry=... ma_key=...`.
+
+New member:
+
+```
+frxd --onboarding
+```
+
+The wizard asks for a config path, accepts the pasted credential block (or field-by-field entry), generates keypairs, enrolls the new key with the MA (redeeming the single-use invite token), verifies the signed registry snapshot, takes relay defaults from the registry, optionally shares a directory, writes the config, and offers to start serving. If enrollment is unavailable (file-path registry), it prints the exact `registry add` command the operator must run.
+
 ## Relay with TLS (one line)
 
 Run `frxd` on loopback and terminate TLS with Caddy: