Add sync health and explicit sync trigger

AGENTS.md

@@ -109,9 +109,10 @@ Roadmap items should be actionable and checkable:
   and `geth peer auth-check` over Iroh, signed peer-card LAN discovery payloads,
   authorized `geth cas fetch`, `geth ssh cert sync`, and
   `geth ssh revocation sync` over the Iroh control ALPN, a background SSH
-  metadata and KV live-sync loop with per-peer cursors in `module_state` and an
-  authorized sync-status summary that lets peers disclose only permitted stream
-  watermarks before module pulls,
+  metadata, keychain/auth, KV, DB, document, and file-root live-sync loop with
+  per-peer cursors in `module_state`, `geth sync status`/`geth sync now`, and
+  an authorized sync-status summary that lets peers disclose only permitted
+  stream watermarks before module pulls,
   untrusted discovery-backend trait, custom relay-map config, and Iroh
   local-network discovery toggle exist.
 - Canonical signed-operation envelopes exist for keychain/auth signature