docs: update README for P-256 ECDH, first admin setup, release filenames

- Replace X25519 references with ECDH P-256 throughout encryption model
- Expand first admin user section: register normally, promote via SQL,
  then manage further admins through the UI
- Update desktop install table with actual DMG filenames and Mac entries

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

README.md

@@ -49,15 +49,15 @@ All encryption and decryption happens exclusively in the browser/client. The bac
 |---|---|---|
 | Password-derived key | PBKDF2-SHA256 (600 000 iterations) | In-memory only, derived at login |
 | Master key | AES-256-GCM | Encrypted with derived key, stored on server |
-| X25519 keypair | X25519 ECDH | Private key encrypted with master key, stored on server; public key stored plaintext |
-| Conversation key | AES-256-GCM | Per-conversation symmetric key, encrypted with each member's X25519 public key |
+| ECDH keypair | P-256 ECDH | Private key encrypted with master key, stored on server; public key stored plaintext |
+| Conversation key | AES-256-GCM | Per-conversation symmetric key, sealed with each member's P-256 public key |
 | File key | AES-256-GCM | Per-file symmetric key, encrypted with owner's master key |
 
 ### Message flow
 
 1. Alice opens a conversation with Bob
 2. Client generates a random AES-256-GCM conversation key
-3. Key is sealed with Bob's X25519 public key (ephemeral ECDH + HKDF + AES-GCM)
+3. Key is sealed with Bob's P-256 public key (ephemeral ECDH + HKDF-SHA256 + AES-GCM)
 4. Ciphertext of the key is stored in `conversation_members.encrypted_key`
 5. Each message is encrypted with the conversation key
 6. Server stores and relays only ciphertext — it never sees plaintext
@@ -201,14 +201,16 @@ openssl rand -hex 32
 
 ### First admin user
 
-After the stack is up, register a normal account, then promote it:
+There are no default credentials. Register a normal account via the UI, then promote it to admin with one SQL command:
 
 ```bash
 docker exec -i cloudlink-postgres-1 psql -U cloudlink -d cloudlink \
   -c "UPDATE users SET is_admin = true WHERE email = 'you@example.com';"
 ```
 
-Subsequent admins can be toggled from the Admin portal in the UI.
+After that, the **Admin** link appears in the sidebar. From there you can promote or demote any other user without touching SQL again.
+
+> **Tip:** The container name may vary. Run `docker ps --format '{{.Names}}'` to confirm it.
 
 ---
 
@@ -220,9 +222,10 @@ Download the installer for your OS from [Releases](https://git.necloud.us/nate/c
 
 | OS | File | Install |
 |---|---|---|
-| Windows | `CloudLink Setup.exe` | Run the installer, follow wizard |
-| Linux | `CloudLink.AppImage` | `chmod +x CloudLink.AppImage && ./CloudLink.AppImage` |
-| Mac | `CloudLink.dmg` | Open DMG, drag to Applications *(built locally — see below)* |
+| Mac (Apple Silicon) | `CloudLink-*-arm64.dmg` | Open DMG, drag to Applications, right-click → Open |
+| Mac (Intel) | `CloudLink-*.dmg` | Open DMG, drag to Applications, right-click → Open |
+| Windows | `CloudLink Setup *.exe` | Run installer, follow wizard |
+| Linux | `CloudLink-*.AppImage` | `chmod +x CloudLink-*.AppImage && ./CloudLink-*.AppImage` |
 
 On first launch the app prompts for your CloudLink server URL (e.g. `https://cloudlink.example.com`). This is saved and used for all future launches.