docs: full reference for the daemon and echo services (modes, extbans, snomasks, commands, config reference, privileges, CLI, metrics/rpc, per-service pages)

content/docs/cli.md

@@ -0,0 +1,50 @@
+# CLI tools
+
+The `echoircd` binary dispatches on its first argument. Any first argument that is not one of the
+subcommands below is treated as the path to a config file to boot the server with.
+
+## Boot the server
+
+```sh
+echoircd [config]
+```
+
+Loads the config (default `echoircd.conf`), binds the plaintext / TLS / S2S / WebSocket / RPC /
+metrics listeners, and runs the single-threaded core.
+
+## rehash
+
+```sh
+echoircd rehash [config]
+```
+
+Signal a **running** server to reload its configuration in place — it finds the process via the
+pidfile (or a `/proc` scan) and sends `SIGHUP`, then exits without booting a new server. Most options
+re-apply live, and the TLS certificate is re-read, with no restart and no disconnects.
+
+## checkconfig
+
+```sh
+echoircd checkconfig [config]
+```
+
+Parse a config and print a deterministic, sorted dump of every key/value it produces — validate a
+config before deploying it, or diff two configs (for example the block form against the legacy flat
+form). Exits non-zero on an unreadable file or an empty `servername`.
+
+## mkpasswd
+
+```sh
+echoircd mkpasswd [cost]
+```
+
+Read a password from **stdin** (never from the command line, to keep it out of `ps` and shell
+history) and print its bcrypt hash — a config-ready value for an `oper` block's `password`. Takes an
+optional bcrypt cost (default 11).
+
+```sh
+printf '%s' 'my-secret' | echoircd mkpasswd
+```
+
+> The in-daemon `MKPASSWD` **command** is separate from this CLI subcommand: the command supports
+> md5/sha1/sha256/sha512/pbkdf2 for oper-issued credentials, while the CLI produces a bcrypt hash.