docs: document syscalls plugin PPP interface and internals