Add setup selftest and diagnostics polish

README.md

@@ -123,9 +123,10 @@ dosh --version
 
 `dosh update` first tries a release tarball named for the platform
 (`dosh-macos-aarch64.tar.gz`, `dosh-linux-x86_64.tar.gz`, etc.) from the latest
-Gitea/GitHub release. If that asset is not published yet, it falls back to the
-source build path. If the release also publishes `<artifact>.sha256`, the installer
-verifies the archive before installing it.
+Gitea/GitHub release. Gitea's concrete tag download route is detected when
+`/releases/latest/download/...` is not supported. If that asset is not published
+yet, it falls back to the source build path. If the release also publishes
+`<artifact>.sha256`, the installer verifies the archive before installing it.
 
 Install the client on Windows PowerShell:
 
@@ -139,6 +140,19 @@ Attach:
 dosh user@server.example.com
 ```
 
+First-time setup for an existing SSH alias:
+
+```bash
+dosh setup homelab
+dosh selftest homelab
+dosh homelab
+```
+
+`dosh setup <ssh-alias>` imports the OpenSSH alias into
+`~/.config/dosh/hosts.toml`, pins the Dosh host key over SSH, runs `dosh doctor`,
+and prints next commands. `dosh selftest <host>` checks local terminal overlay
+safety, forwarding syntax, and the remote doctor path.
+
 Plain `dosh user@server.example.com` opens a fresh terminal session. Use named
 sessions when you want to reattach to the same persistent terminal from multiple
 clients:
@@ -165,6 +179,13 @@ If SSH and UDP use different public names, specify the UDP address:
 dosh-client --dosh-host public.example.com --dosh-port 50000 user@host
 ```
 
+Forwarding can use SSH-shaped flags directly or the forward-only wrapper:
+
+```bash
+dosh -N -L 8080:127.0.0.1:80 homelab
+dosh forward homelab -L 8080:127.0.0.1:80 -D 1080
+```
+
 Dosh already lets OpenSSH handle SSH aliases, users, keys, ports, known-hosts,
 ProxyJump, and other SSH config during bootstrap. It also runs `ssh -G` to infer the
 UDP host from an SSH alias when `dosh_host` is not configured. To make that explicit