Live sync SSH metadata in background

docs/roadmap.md

@@ -214,6 +214,10 @@ resource-scoped capability decisions.
     `geth ssh cert sync <node-id>`.
   - `[x]` Authorized peers can pull SSH revocation metadata with
     `geth ssh revocation sync <node-id>`.
+  - `[x]` The daemon background live-sync loop refreshes known peers without a
+    manual command.
+  - `[x]` SSH metadata live-sync stores per-peer high-water cursors in
+    `module_state` and requests only records at or beyond the cursor.
   - `[ ]` Future completion requires auth checks for local request, approve,
     import, publish, and read capabilities.
 
@@ -318,6 +322,8 @@ Goal: add authorized stream-oriented management workflows over Iroh.
     `resource:ssh:revocations`.
   - `[x]` Consumers can list current certs/revocations from local state while
     offline after sync.
+  - `[x]` Background live-sync uses the same protected Iroh path and cursor
+    state as manual sync.
   - `[ ]` Replace pull-only metadata sync with a resource log or CRDT model.
   - `[ ]` Conflicting or unsigned records are rejected or quarantined.