Add authorized Unix pipe forwarding

docs/architecture.md

@@ -219,7 +219,10 @@ local loopback listener and opens one authorized `/geth/pipe/1` byte stream per
 accepted connection. The remote daemon validates endpoint/card binding and
 requires `pipe.forward` on `resource:pipe-tcp:<target>` before connecting to the
 remote loopback TCP target. TCP forwarding is loopback-only in the prototype;
-Unix socket forwarding is still future work.
+`geth pipe forward-unix --listen <local-socket> --node <node-id> --target
+<remote-socket>` uses the same authorized Iroh pipe stream and requires
+`pipe.forward` on `resource:pipe-unix:<target>` before connecting to an absolute
+remote Unix socket path.
 
 `geth-ssh-proxy` defines proxy target and connection metadata. `geth ssh proxy
 <node>` is a streaming command intended for OpenSSH `ProxyCommand`: the CLI

docs/roadmap.md

@@ -385,11 +385,17 @@ Goal: add authorized stream-oriented management workflows over Iroh.
     request/response serialization.
   - `[ ]` Tests cover a full two-node request/response forwarding exchange.
 
-- `[ ]` Unix socket forwarding where supported.
+- `[~]` Unix socket forwarding where supported.
   Acceptance criteria:
-  - Unix socket forwarding is available on Unix platforms.
-  - Unsupported platforms return clear errors.
-  - Tests skip or use cfg guards where sockets are unavailable.
+  - `[x]` Unix socket forwarding is available on Unix platforms through
+    `geth pipe forward-unix`.
+  - `[x]` Forwarding is resource-scoped with `pipe.forward` on
+    `resource:pipe-unix:<target>`.
+  - `[x]` Unix socket paths must be absolute and reject parent-directory
+    components.
+  - `[x]` Tests cover Unix path validation and pipe wire request serialization.
+  - `[ ]` Unsupported platforms return clear errors.
+  - `[ ]` Tests cover a full two-node Unix socket forwarding exchange.
 
 - `[~]` SSH proxy over Iroh.
   Acceptance criteria: