packaging: refresh OpenWrt ipk README

Bring the packaging README into agreement with what the ipk actually
installs and the CLI surface fipsctl exposes today:

- Package contents table now lists /usr/bin/fips-gateway,
  /etc/init.d/fips-gateway, and /etc/sysctl.d/fips-gateway.conf
  alongside the daemon. These have been part of the install block
  but were missing from the README.
- fipsctl examples updated to the current command form
  (fipsctl show peers / show links / show sessions in place of the
  removed shorthands), with a pointer to the canonical CLI reference.
- Service management section gains a short subsection covering the
  optional gateway service, including the enable/start incantation
  and a link to the deploy-fips-gateway tutorial.

packaging/openwrt-ipk/README.md

@@ -11,13 +11,16 @@ For ad-hoc deployment without the build system, see
 | Installed path | Purpose |
 |---|---|
 | `/usr/bin/fips` | Mesh daemon |
-| `/usr/bin/fipsctl` | CLI control tool (`fipsctl peers`, `fipsctl links`, …) |
+| `/usr/bin/fipsctl` | CLI control tool (`fipsctl show peers`, `fipsctl show links`, …) |
 | `/usr/bin/fipstop` | Live TUI dashboard |
-| `/etc/init.d/fips` | procd service (auto-start, crash respawn) |
+| `/usr/bin/fips-gateway` | Outbound LAN gateway service (not started by default) |
+| `/etc/init.d/fips` | procd service for the daemon (auto-start, crash respawn) |
+| `/etc/init.d/fips-gateway` | procd service for the gateway (disabled by default) |
 | `/etc/fips/fips.yaml` | Node configuration (edit before first start) |
 | `/etc/fips/firewall.sh` | Firewall helper — accepts traffic on `fips0` |
 | `/etc/dnsmasq.d/fips.conf` | Forwards `.fips` DNS queries to the daemon |
 | `/etc/sysctl.d/fips-bridge.conf` | `br_netfilter` settings for Ethernet transport |
+| `/etc/sysctl.d/fips-gateway.conf` | `proxy_ndp` and IPv6 forwarding for the gateway |
 | `/etc/hotplug.d/net/99-fips` | Applies firewall rules when `fips0` comes up |
 | `/etc/uci-defaults/90-fips-setup` | First-boot kernel module and firewall setup |
 | `/lib/upgrade/keep.d/fips` | Preserves `/etc/fips/` across `sysupgrade` |
@@ -142,17 +145,35 @@ physical interface names for your router. **Always use physical port names
 /etc/init.d/fips disable
 ```
 
+### Outbound LAN gateway (optional)
+
+The `fips-gateway` service is installed but disabled by default. It
+turns the router into an outbound gateway that bridges LAN clients
+onto the FIPS mesh. Enable only after configuring a `gateway:`
+section in `/etc/fips/fips.yaml`:
+
+```bash
+/etc/init.d/fips-gateway enable
+/etc/init.d/fips-gateway start
+```
+
+See `docs/tutorials/deploy-fips-gateway.md` in the source tree for
+the full walkthrough.
+
 ## Inspection and logs
 
 ```bash
-# Peer table
-fipsctl peers
+# Node-level status overview
+fipsctl show status
 
-# Active sessions
-fipsctl sessions
+# Peer table
+fipsctl show peers
 
 # Transport links
-fipsctl links
+fipsctl show links
+
+# Active end-to-end sessions
+fipsctl show sessions
 
 # Live TUI dashboard
 fipstop
@@ -161,6 +182,9 @@ fipstop
 logread | grep fips
 ```
 
+See [`docs/reference/cli-fipsctl.md`](../../docs/reference/cli-fipsctl.md)
+for the full subcommand list.
+
 ## Upgrading
 
 Install the new `.ipk` over the existing one: