Support multiple Telebit client bindings

README.md

@@ -113,7 +113,7 @@ Create a new tunnel key for a subdomain:
 ./telebitctl bind test
 ```
 
-This creates `test.$DOMAIN` and writes `telebit-client.env`.
+This creates `test.$DOMAIN` and writes `.telebit-clients/test.env`.
 
 Run the tunnel to a local service:
 
@@ -127,10 +127,13 @@ That forwards:
 https://test.$DOMAIN -> localhost:80
 ```
 
-`up` also installs the active client config to:
+`up` uses a per-slug client config. If `.telebit-clients/test.env` already exists, it reuses that key and only updates the local port. If it does not exist, it binds `test` before starting the tunnel.
 
-```text
-~/.config/telebit/client.env
+Because each slug has its own env file, multiple tunnels can run at the same time:
+
+```sh
+telebitctl up app 3000
+telebitctl up api 8080
 ```
 
 Rotate the client key:
@@ -147,7 +150,7 @@ Release a subdomain:
 
 ## Notes
 
-- `.env`, `telebit-client.env`, and `bin/` are ignored by git.
+- `.env`, `.telebit-clients/`, `telebit-client.env`, and `bin/` are ignored by git.
 - `SECRET` in `.env` is the management/relay master secret. Do not use it directly as a long-lived client key.
 - Client keys are one-time registration secrets. Use `bind` or `auth refresh` to create device-specific keys.
 - If `/ws` returns nginx `502`, nginx is probably still proxying to `https://127.0.0.1:8085`; it must use `http://127.0.0.1:8085`.