docs: plan HTTPS peers and source install

docs/install.md

@@ -5,7 +5,8 @@ Docker image) into a running, enabled systemd service on a Linux host. It is
 the supported way to deploy the worker: it writes the configuration, the
 systemd unit, and the data directory, then starts the service.
 
-> A shell installer that downloads a pre-built binary is planned. Today
+> A Go SSH source installer is planned in
+> [source-installation.md](source-installation.md). Today
 > `install` copies the binary you invoke it from (or pulls the `--image`
 > digest), so build first with `make build` and run the resulting
 > `./bin/rsmon-worker`.
@@ -53,7 +54,7 @@ values automatically. To override a value, pass the matching flag.
 | `RSMON_TOKEN` | yes | none | Worker bearer token. |
 | `WORKER_HOST` | no | `127.0.0.1` | Operator-console bind address. |
 | `WORKER_PORT` | no | `27401` (primary) | Operator-console port. **Required** for named instances. |
-| `WORKER_URL` | no | none | Public URL advertised to the control plane. |
+| `PUBLIC_URL` | no | none | Proposed public HTTPS origin; accepted by the control plane. |
 | `WORKER_LOGIN` | no | `admin` (generated) | Operator-console basic-auth login. |
 | `WORKER_PASSWORD` | no | generated | Operator-console basic-auth password. |
 | `WORKER_COMPOSE_ENABLED` | no | feature default (on) | Enable Docker Compose discovery/management. |
@@ -66,6 +67,11 @@ writes it to the env file, and prints it once. Record it; the operator console
 requires it for both the browser login and the `/web/api/*` HTTP basic-auth
 endpoints.
 
+`PUBLIC_URL` does not bind a listener or terminate TLS. It advertises the one
+external origin used for the console, authenticated peer status, and planned
+Raft `/raft` transport. See
+[public-endpoint-and-identity.md](public-endpoint-and-identity.md).
+
 Values must be systemd-safe: no whitespace, quotes, backslashes, or `$`
 interpolation inside a value. This keeps the file unambiguous across systemd
 `EnvironmentFile` and `docker --env-file`.