Add the shared packages for the sharks stack

model, tunnel, wg, authtoken, netguard, docker and dotenv, split out of the
original single repository so Hammerhead, Blacktip and Bamboo can live in
their own repos and import them. README extended; LICENSE unchanged.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

README.md

@@ -1,3 +1,34 @@
 # Reef
 
-A shared library for Hammerhead, Blacktip, and Bamboo
+A shared library for Hammerhead, Blacktip, and Bamboo
+
+Shared types and building blocks for the sharks stack: [Hammerhead](https://git.veillax.com/Veillax/hammerhead) (control plane), [Blacktip](https://git.veillax.com/Veillax/blacktip) (edge) and [Bamboo](https://git.veillax.com/Veillax/bamboo) (site agent).
+
+Reef holds the code all three programs agree on, so each can be built and released from its own repository.
+
+| Package | What it is |
+|---|---|
+| `model` | The data types passed between the programs: edges, sites, ports, mail egress, DKIM keys, alert-relevant status and reports |
+| `tunnel` | The wire format used inside the WireGuard tunnel, and the helper that pipes two connections together |
+| `wg` | wireguard-go with a userspace network stack: no root, no kernel interface, works on Windows, macOS and Linux |
+| `authtoken` | Signed, expiring login tokens with a revocation epoch |
+| `netguard` | Refuses internal addresses for anything that connects out on a user's behalf (webhooks, mail delivery), and dials the address it checked |
+| `docker` | Lists running containers through the Docker Engine API, with no SDK |
+| `dotenv` | Loads a `.env` file into the environment without overriding real variables |
+
+## Using it
+
+```
+go env -w GOPRIVATE=git.veillax.com   # once, so Go fetches straight from this server
+go get git.veillax.com/Veillax/reef@latest
+```
+
+## Tests
+
+```
+go test ./...
+```
+
+## License
+
+AGPL-3.0. See `LICENSE`.