Add peer card discovery scaffold

crates/geth/Cargo.toml

@@ -20,4 +20,5 @@ geth-cas = { path = "../geth-cas" }
 geth-config = { path = "../geth-config" }
 geth-control = { path = "../geth-control" }
 geth-node = { path = "../geth-node" }
+geth-store = { path = "../geth-store" }
 tempfile.workspace = true

crates/geth/tests/bootstrap.rs

@@ -116,6 +116,38 @@ fn initialized_node_can_roundtrip_cas_blob() {
     );
 }
 
+#[test]
+fn auth_explain_distinguishes_discovered_peer_candidates() {
+    let home = tempfile::tempdir().expect("tempdir");
+    let paths = geth_config::GethPaths::from_home(home.path());
+    let node = geth_node::init_node(&paths).expect("init node");
+    let store = geth_store::Store::open(&paths.metadata_db()).expect("open store");
+    store
+        .upsert_peer_card(&geth_store::StoredPeerCard {
+            peer_id: "node:discovered".to_owned(),
+            card_json: r#"{"node_id":"node:discovered"}"#.to_owned(),
+            updated_at_ms: 1,
+        })
+        .expect("insert peer card");
+
+    let response = geth_node::handle_request(
+        &node,
+        geth_control::ControlRequest::AuthExplain {
+            subject: "node:discovered".to_owned(),
+            resource: "resource:cas:local".to_owned(),
+            capability: "cas.fetch".to_owned(),
+        },
+    )
+    .expect("auth explain");
+    match response {
+        geth_control::ControlResponse::AuthExplain(explanation) => {
+            assert!(!explanation.allowed);
+            assert!(explanation.reason.contains("discovered peer candidate"));
+        }
+        other => panic!("unexpected response: {other:?}"),
+    }
+}
+
 #[test]
 fn ssh_cert_request_approval_and_revocation_export_use_local_state() {
     let home = tempfile::tempdir().expect("tempdir");