docs: comprehensive CLI documentation audit and fixes (#12)

* docs: comprehensive CLI reference update to match implementation

- Remove non-existent 'rpc' command (gRPC server auto-starts via SDK)
- Update badge issue flags: add --self-sign, --level, --aud
- Update badge verify flags: add --offline, --audience, --skip-revocation, --skip-agent-status, --trusted-issuers
- Update badge keep flags to match actual CLI
- Add trust command section (add/list/remove)
- Fix default values to match actual defaults (5m exp instead of 1h)
- Add Node.js wrapper commands to wrapper section
- Update gRPC section to explain auto-start behavior and list all 7 services
- Update verification date to 2025-12-26

* docs: comprehensive CLI documentation audit and fixes

BREAKING CHANGES in documentation:
- capiscio keygen → capiscio key gen (command doesn't exist)
- capiscio badge sign → capiscio badge issue (command doesn't exist)
- capiscio badge revoke → Registry API (command doesn't exist)
- capiscio rpc → auto-managed by SDK (command doesn't exist)
- --accept-self-signed → --offline (flag doesn't exist)
- --output → --out-priv/--out-pub (flag doesn't exist)

Fixed files:
- docs/getting-started/index.md: key gen command, prerequisites table
- docs/identity/index.md: key gen command, file extensions (.jwk not .pem)
- docs/trust/index.md: badge issue/request commands, revocation via API
- docs/index.md: key gen and badge issue commands
- docs/reference/cli/index.md: badge issue examples
- docs/reference/grpc.md: removed non-existent CLI Usage section
- docs/reference/wrappers/node.md: badge verify flags
- docs/how-to/security/badgeserify flags
- docs/concepts/trust-model.md: --offline flag reference

Verified against: capiscio-core v2.2.0 --help output
Audit date: 2025-12-26

Author: beonde

docs/concepts/trust-model.md

@@ -184,7 +184,7 @@ Trust levels indicate the validation rigor applied during badge issuance:
 | **4** | Extended Validated (EV) | OV + manual security audit | CapiscIO CA | Regulated industries |
 
 !!! warning "Level 0 in Production"
-    Self-signed (Level 0) badges are for **development only**. In production, verifiers should reject Level 0 badges by default. Use `--accept-self-signed` (CLI) or `accept_self_signed=True` (SDK) to explicitly opt in during development.
+    Self-signed (Level 0) badges are for **development only**. In production, verifiers should reject Level 0 badges by default. Use `--offline` (CLI) for trust store verification, or `accept_self_signed=True` (SDK) to explicitly opt in during development.
 
 ### DID Methods by Level
 

docs/getting-started/index.md

@@ -28,7 +28,7 @@ npm install -g capiscio       # or: pip install capiscio
     Generate a DID for your agent in 60 seconds.
 
     ```bash
-    capiscio keygen
+    capiscio key gen
     ```
 
     [:octicons-arrow-right-24: Identity Guide](../identity/index.md)
@@ -101,7 +101,7 @@ EOF
 capiscio validate agent-card.json
 
 # 4. Generate identity
-capiscio keygen --output ./capiscio_keys
+mkdir -p capiscio_keys && cd capiscio_keys && capiscio key gen && cd ..
 ```
 
 **Done!** You have a validated agent card and a cryptographic identity.
@@ -112,7 +112,7 @@ capiscio keygen --output ./capiscio_keys
 
 | Path | Requirements |
 |------|--------------|
-| CLI (validate, keygen) | Node.js 18+ or Python 3.10+ |
+| CLI (validate, key gen) | Node.js 18+ or Python 3.10+ |
 | Python SDK (SimpleGuard) | Python 3.10+, FastAPI or similar |
 | CI/CD | GitHub repository |
 

docs/how-to/security/badges.md

@@ -144,10 +144,10 @@ For development and testing, issue self-signed badges:
 
     ```bash
     # Issue a self-signed badge (Level 0)
-    capiscio badge issue --self-sign > badge.jwt
+    capiscio badge issue --self-sign --sub did:web:example.com:agents:test > badge.jwt
 
-    # Verify with explicit self-signed acceptance
-    capiscio badge verify --accept-self-signed < badge.jwt
+    # Verify offline (uses trust store)
+    capiscio badge verify --offline < badge.jwt
     ```
 
 === "Python SDK"

docs/identity/index.md

@@ -46,7 +46,7 @@ This DID:
     No registration needed. Generate a `did:key` identity locally:
 
     ```bash
-    capiscio keygen --output ./capiscio_keys
+    mkdir -p capiscio_keys && cd capiscio_keys && capiscio key gen && cd ..
     ```
 
     ```
@@ -55,8 +55,8 @@ This DID:
     Your Agent DID: did:key:z6MkhaXgBZDvotDkL5257faiztiGiC2QtKLGpbnnEGta2doK
 
     Files created:
-      ./capiscio_keys/private.pem (keep secret!)
-      ./capiscio_keys/public.pem
+      ./capiscio_keys/private.jwk (keep secret!)
+      ./capiscio_keys/public.jwk
     ```
 
     **Trust Level:** 0 (self-signed) — Great for development and testing.
@@ -66,15 +66,15 @@ This DID:
     Use `did:key` for development and self-signed badges:
 
     ```bash
-    capiscio keygen
+    capiscio key gen
     ```
 
     ```
     ✅ Keys generated!
 
     DID: did:key:z6Mk...
-    Private key: capiscio_keys/private.pem
-    Public key: capiscio_keys/public.pem
+    Private key: private.jwk
+    Public key: public.jwk
 
     Next: Use this DID in your agent card.
     ```

docs/index.md

@@ -200,7 +200,7 @@ We obsess over developer experience. Every feature works in **three commands or
 === "Generate Identity"
 
     ```bash
-    capiscio keygen
+    capiscio key gen
     # ✅ did:key:z6Mk... generated
     ```
 
@@ -214,8 +214,8 @@ We obsess over developer experience. Every feature works in **three commands or
 === "Issue Badge"
 
     ```bash
-    capiscio badge sign --trust-level 2
-    # ✅ Badge signed with private key
+    capiscio badge issue --self-sign
+    # ✅ Badge issued with did:key identity
     ```
 
 === "Add to Your App"