Add smooth node enrollment flow

AGENTS.md

@@ -119,9 +119,11 @@ Roadmap items should be actionable and checkable:
   users, devices, nodes, agents, and endpoint bindings.
 - The auth reducer builds a current permission view for resources, grants,
   groups, and bearer access. The daemon persists local auth grant/revoke ops
-  and uses them for `auth explain`. `kv set --subject <principal>` enforces
-  local KV write grants for non-local test callers. Signature validation and
-  broader daemon-side module enforcement are still roadmap work.
+  and uses them for `auth explain`. Enrollment approval signs auth ops, and
+  `geth auth sync <node>` imports only auth ops signed by currently trusted
+  admin keys. `kv set --subject <principal>` enforces local KV write grants for
+  non-local test callers. Broader daemon-side module enforcement is still
+  roadmap work.
 - The daemon persists local keychain ops and reduces them for `keychain status`.
   `geth init --admin-key <pub> --signing-key <key> --node-name <name>` records
   signed owner/user/device/node/agent binding operations. `keychain
@@ -132,6 +134,8 @@ Roadmap items should be actionable and checkable:
   ops with valid OpenSSH signatures from currently trusted admin keys. `geth
   node list/rename/revoke/grant` are the current node-management surface over
   that reduced keychain/auth view; rename and revoke require `--signing-key`.
+  `geth node enroll request|submit|import|list|approve|sync` is the smooth
+  new-device flow.
 - Local CAS supports pin/unpin metadata, surfaced through `cas list`, and
   `cas cleanup` evicts unpinned blobs while retaining pinned blobs. The daemon
   can fetch CAS blobs from an imported signed peer card over Iroh when the peer