Add authorized remote pipe listen

docs/architecture.md

@@ -198,8 +198,10 @@ registry. `geth pipe connect <name> --node <node-id>` sends an authorized remote
 connect request over the protected Iroh control ALPN. The remote daemon validates
 endpoint/card binding and requires `pipe.connect` on `resource:pipe:<name>`
 before recording the connection attempt and reporting whether a listener exists.
-This is still a control-plane scaffold for names and connection attempts only;
-it does not carry bytes or forward sockets yet.
+`geth pipe listen <name> --node <node-id>` can also ask a peer to register a
+daemon-lifetime listener after checking `pipe.listen` on the same resource. This
+is still a control-plane scaffold for names, listeners, and connection attempts
+only; it does not carry bytes or forward sockets yet.
 
 `geth-ssh-proxy` currently defines proxy target and connection metadata. The
 daemon can authorize a remote proxy attempt over the protected Iroh control ALPN

docs/roadmap.md

@@ -349,8 +349,11 @@ Goal: add authorized stream-oriented management workflows over Iroh.
     imported peer over Iroh at the control-plane level.
   - `[x]` Remote pipe connect requires `pipe.connect` on
     `resource:pipe:<name>`.
-  - `[ ]` Remote pipe listen requires `pipe.listen` when remote listener
-    creation is added.
+  - `[x]` `geth pipe listen <name> --node <node-id>` can register an authorized
+    daemon-lifetime listener on an imported peer.
+  - `[x]` Remote pipe listen requires `pipe.listen` on
+    `resource:pipe:<name>`.
+  - `[x]` Tests cover denied and allowed remote listener registration.
   - `[ ]` Pipe connect carries bidirectional byte streams over Iroh.
   - `[ ]` Streams close cleanly and propagate errors.