Add Iroh relay mode config

docs/architecture.md

@@ -2,8 +2,8 @@
 
 `geth` is a single-binary local-first mesh runtime. One executable provides both
 daemon mode and control mode. The daemon owns local identity, metadata storage,
-the future shared Iroh endpoint, resource registry, module routing, and local
-control socket. Control commands connect to the Unix socket and send typed JSONL
+the shared Iroh endpoint, resource registry, module routing, and local control
+socket. Control commands connect to the Unix socket and send typed JSONL
 requests.
 
 Service management is also exposed through the single binary. `geth daemon
@@ -23,8 +23,9 @@ Rust-1.85-compatible candidates in the 0.93-0.95 range failed to compile through
 a transitive `ed25519-dalek` prerelease dependency. `geth-iroh` wraps
 `iroh::Endpoint::builder()`, configures geth ALPNs with `Builder::alpns`, uses
 `Builder::relay_mode`, persists an `iroh::SecretKey` as hex-encoded 32-byte key
-material, and shuts down through `Endpoint::close().await`. Relay mode defaults
-to disabled until daemon policy and discovery are implemented.
+material, and shuts down through `Endpoint::close().await`. The default config
+uses Iroh's default relay policy; local-only/offline development can set
+`[iroh].relay_mode = "disabled"`.
 
 The target product should use Iroh relay support for practical internet
 connectivity and mDNS/LAN discovery for local networks. These are connectivity

docs/roadmap.md

@@ -74,14 +74,20 @@ geth-to-geth connections without granting trust from discovery alone.
   - Endpoint identity is bound to agent/node identity in local metadata.
   - Restarting the daemon preserves higher-level node identity.
 
-- `[ ]` Relay policy and configuration.
+- `[x]` Built-in relay policy and configuration.
   Acceptance criteria:
-  - Config can select disabled, default Iroh relays, staging relays, and future
-    custom relay maps.
+  - Config can select disabled, default Iroh relays, and staging relays.
   - The intended product default uses relays unless explicitly disabled.
   - `geth status --json` reports the selected relay mode.
   - Tests cover config parsing and endpoint builder relay-mode selection.
 
+- `[ ]` Custom relay maps.
+  Acceptance criteria:
+  - Config can define and select named custom relay maps.
+  - Invalid relay URLs fail config validation with clear errors.
+  - Status output identifies the selected custom relay map without exposing
+    unrelated config.
+
 - `[ ]` LAN mDNS discovery.
   Acceptance criteria:
   - The daemon can advertise and discover local geth peer cards over mDNS.