docs(mesh): note admin-only management, dev-mode diagnostics, and the subnet env var (#1288)

- Note that managing the mesh (the per-node toggle and stack opt-in or
  opt-out) requires an administrator and that non-admin users see the
  Routing tab read-only, matching the access model the tab enforces.
- Document the [Mesh:diag] developer-mode logs in the Diagnostics section
  so operators can trace routing decisions and operation timing.
- Add SENCHO_MESH_SUBNET to .env.example; it was documented on the feature
  page but missing from the env template.

.env.example

@@ -127,6 +127,13 @@ SENCHO_EXPERIMENTAL=false
 # the next mesh dial re-opens it. Default 0 (persistent).
 SENCHO_MESH_PROXY_TUNNEL_IDLE_MS=0
 
+# Mesh network subnet for this node. Leave unset to let Sencho pick the first
+# free /24 from its candidate list (172.30.0.0/24, 172.31.0.0/24, 10.42.0.0/24,
+# 10.43.0.0/24), or adopt the existing sencho_mesh network's subnet when it is
+# already present. Set a specific CIDR only when you need to avoid an overlap
+# with another network on this host. Configured independently per node.
+# SENCHO_MESH_SUBNET=10.42.0.0/24
+
 # Maximum bytes a single Git Source clone may download from the Git host before
 # it is aborted. This bounds network transfer and abuse, not the decompressed
 # on-disk size. A shallow clone of a compose repo is tiny; raise this only if