Add Iroh peer ping

docs/roadmap.md

@@ -98,6 +98,8 @@ geth-to-geth connections without granting trust from discovery alone.
   Acceptance criteria:
   - `[x]` Manual `geth peer export/import/list` can exchange signed peer cards
     and store them as untrusted candidates.
+  - `[x]` Exported daemon peer cards include Iroh EndpointID plus available
+    relay/direct address candidates.
   - `[ ]` The daemon can advertise and discover signed geth peer cards over LAN
     discovery.
   - `[x]` Imported peer cards are stored only as untrusted peer candidates.
@@ -125,11 +127,18 @@ geth-to-geth connections without granting trust from discovery alone.
   - No discovery result grants capabilities or trust.
   - `auth explain` can distinguish "discovered" from "trusted".
 
-- `[ ]` Basic authenticated peer connection.
+- `[~]` Basic authenticated peer connection.
   Acceptance criteria:
-  - A node can dial another node over Iroh using an EndpointID from a peer card.
-  - The remote side proves an agent/node binding before module access.
-  - Knowing only an EndpointID is insufficient to access a protected module.
+  - `[x]` `geth peer ping <node-id>` dials another node over Iroh using an
+    imported signed peer card.
+  - `[x]` The remote side validates the caller's signed peer card and stores it
+    as a candidate only.
+  - `[x]` The ping response records negotiated ALPN and remote endpoint
+    identity.
+  - `[ ]` The remote side proves an agent/node binding before protected module
+    access.
+  - `[ ]` Protected module handlers reject requests that only know an
+    EndpointID and lack resource capabilities.
 
 ## Phase 2: Trust And Authorization