milestone 21: abp list exceptions and a regex rule kind

docs/how-to/install-with-systemd.md

@@ -184,8 +184,13 @@ was written before the first start.
 
 0640 with group `nxdns` rather than 0600: `/etc/nxdns` is a
 `ConfigurationDirectory`, which systemd leaves owned by root, and the service
-runs as `nxdns` and has to read this file on the first start. A root-owned 0600
-file would be unreadable to it.
+runs as `nxdns`. A root-owned 0600 file would be unreadable to it.
+
+Keep that group read bit for good, not just for the first boot. Under
+`run --config` the service reads this file on **every** start, so tightening
+the mode later breaks the next restart. Under database authority it is
+`nxdns import` that reads the file, as whoever runs that command, and a bare
+`nxdns run` never reads it at all.
 
 Do not expect `nxdns check` to catch a permissive mode here. Its only
 permission warning is for a TLS private key
@@ -220,7 +225,7 @@ nxdns import /etc/nxdns/config.zon
 ```
 
 ```
-info(migrations): config.db migrated from schema version 0 to 2
+info(migrations): config.db migrated from schema version 0 to 4
 imported /etc/nxdns/config.zon
 ```