Upgrade Iroh integration to 1.0

docs/adr/0011-kv-iroh-documents.md

@@ -13,11 +13,11 @@ prefix-scoped capabilities.
 ## Consequences
 
 The prototype keeps SQLite as the durable local KV index and mirrors each named
-KV store into an Iroh Documents namespace on the daemon-owned `iroh 0.95.1`
+KV store into an Iroh Documents namespace on the daemon-owned `iroh 1.0.0`
 endpoint. Remote `geth kv sync` still uses geth control as the authorization
 preflight. If the caller has `kv.read` on the remote `resource:kv:<name>`, the
 remote daemon returns a read-only Iroh Documents ticket and the requester imports
-entries through `iroh-docs 0.95.0`.
+entries through `iroh-docs 0.101.0`.
 
 The daemon must not hand out Iroh Documents write capabilities as a substitute
 for geth authorization. Write authority remains modeled through geth resource

docs/architecture.md

@@ -19,9 +19,11 @@ shared Iroh endpoint and register module protocols on ALPNs such as
 `/geth/cas/1`, `/geth/kv/1`, `/geth/pipe/1`, `/geth/ssh-proxy/1`, and
 `/geth/overlay/1`.
 
-The pinned Iroh integration uses `iroh = 0.95.1`. `geth-iroh` wraps
-`iroh::Endpoint::builder()`, configures geth ALPNs with `Builder::alpns`, uses
-`Builder::relay_mode`, persists an `iroh::SecretKey` as hex-encoded 32-byte key
+The pinned Iroh integration uses `iroh = 1.0.0`. `geth-iroh` wraps
+`iroh::Endpoint::builder(iroh::endpoint::presets::N0)`, configures geth
+ALPNs with `Builder::alpns`, uses `Builder::relay_mode`, adds
+`iroh-mdns-address-lookup` when local discovery is enabled, persists an
+`iroh::SecretKey` as hex-encoded 32-byte key
 material, and shuts down through `Endpoint::close().await`. The default config
 uses Iroh's default relay policy; local-only/offline development can set
 `[iroh].relay_mode = "disabled"`. Named custom relay maps are configured under
@@ -31,7 +33,7 @@ uses Iroh's default relay policy; local-only/offline development can set
 
 The native module-backend crates for the intended CAS, KV, and pubsub
 replacements now compile against the same endpoint generation:
-`iroh-blobs 0.97.0`, `iroh-docs 0.95.0`, and `iroh-gossip 0.95.0`. `geth-iroh`
+`iroh-blobs 0.103.0`, `iroh-docs 0.101.0`, and `iroh-gossip 0.101.0`. `geth-iroh`
 exposes their native ALPNs without creating a second daemon endpoint. CAS now
 registers an `iroh-blobs` provider handler on `/iroh-bytes/4`; local CAS writes
 are mirrored into the native blob store, and remote `geth cas fetch` performs a

docs/roadmap.md

@@ -191,9 +191,9 @@ Implementation order:
     equivalent.
   - `[x]` Fallback/stub behavior remains clearly marked where APIs are not yet
     pinned.
-  - `[x]` Upgrade `geth-iroh` from `iroh 0.90.0` to an endpoint version
-    compatible with `iroh-blobs`, `iroh-docs`, and `iroh-gossip` without
-    introducing a second daemon endpoint.
+  - `[x]` Upgrade `geth-iroh` to stable `iroh 1.0.0` with matching `iroh-blobs 0.103.0`,
+    `iroh-docs 0.101.0`, and `iroh-gossip 0.101.0` without introducing a
+    second daemon endpoint.
 
 - `[x]` File sync reconciliation polish.
   Acceptance criteria:
@@ -620,8 +620,8 @@ authorization and durable-state boundaries clear.
   - `[x]` `geth cas providers <hash>` lists locally known providers.
   - `[x]` Tests cover local provider metadata storage.
   - `[x]` Replace the bootstrap control-ALPN byte transfer with `iroh-blobs`
-    provider/fetch behavior using the daemon-owned `iroh 0.95.1` endpoint and
-    pinned `iroh-blobs 0.97.0`.
+    provider/fetch behavior using the daemon-owned `iroh 1.0.0` endpoint and
+    pinned `iroh-blobs 0.103.0`.
   - `[x]` CAS fetch keeps the geth control-ALPN authorization preflight before
     opening the native `iroh-blobs` payload transfer.
   - `[x]` Local CAS adds and daemon startup mirror available blobs into the