Add smooth node enrollment flow

docs/architecture.md

@@ -288,13 +288,24 @@ only operations with a valid OpenSSH signature from a currently trusted admin ke
 over the canonical payload. This is currently a pull-based signed operation log,
 not a CRDT or Keyhive-style convergent authority.
 
+New devices can use the node enrollment flow instead of hand-editing keychain
+state. `geth node enroll request` creates a canonical, agent-key-signed request
+containing the requesting node ID, agent ID, requested node name, optional Iroh
+endpoint, and requested resource capabilities. The request can be submitted over
+Iroh to an imported owner peer or moved as a JSON file to the owner machine.
+`geth node enroll approve` runs on the owner/YubiKey machine and records signed
+keychain operations for the device/node/agent/endpoint binding plus signed auth
+operations for approved capabilities. `geth node enroll sync <owner-node>` pulls
+both signed logs so the new node can see its approved identity and permissions.
+
 The authorization plane is `geth-auth`: resource-local signed operation logs,
 grants, revocations, groups, and `auth explain`. Auth operations reduce into a
 current permission view for resources, grants, groups, and bearer access. The
 library can explain direct and group grants. The daemon persists local auth
 grant/revoke operations and `geth auth explain` evaluates that local operation
-log. Signature validation, replication, and module enforcement are still future
-work.
+log. Enrollment approval and auth sync attach and verify OpenSSH admin
+signatures for replicated auth operations. Broader delegated authority and
+module enforcement are still future work.
 
 Capability evaluation supports exact matches plus explicit scoped forms. For KV,
 `kv.write_prefix:<prefix>` grants writes requested as `kv.write_key:<key>` only