Add configuration path explanations

docs/config.md

@@ -95,7 +95,8 @@ The size fields must be zero or greater. The [HTTP API](api.md) defines how
 each limit is enforced and reported. `server.artifact_root` configures an HTTP
 deployment boundary; see [operations](operations.md) for deployment handling.
 
-The `config validate`, `config show`, and `config sources` commands inspect this
+The `config validate`, `config show`, `config sources`, and `config explain`
+commands inspect this
 application configuration without creating a Promptkit engine. `show` is a
 resolved inspection snapshot, not necessarily a reloadable file. Application
 validation does not check framework sources, backend connectivity, or credential
@@ -103,6 +104,12 @@ availability. `api_key_env` is an environment-variable *name* and remains
 visible in inspection; its environment value is never read by ConfigKit.
 Ordinary backend `extra_params` values also remain visible, so keep secrets out
 of those fields and protect inspection output as potentially sensitive.
+`config explain --path /server/addr` uses JSON Pointer syntax to show the
+selected field's current value and history from defaults, files, overlays,
+explicit CLI overrides, and normalization. `--path ''` selects the root.
+History includes replaced and removed values; `show` presents the final
+resolved snapshot. Neither renderer looks up credential bytes, and neither
+claims to identify arbitrary secrets in unclassified parameter values.
 
 ## Custom Backends