Add peer card discovery scaffold

docs/architecture.md

@@ -38,6 +38,12 @@ connectivity and mDNS/LAN discovery for local networks. These are connectivity
 and candidate-discovery mechanisms only. They do not grant trust, mutate
 authorization state, or make EndpointID knowledge sufficient for access.
 
+Peer cards are the discovery payload. A peer card carries node ID, agent ID,
+endpoint candidates, timestamp, and signature metadata. The current scaffold
+stores peer cards as untrusted metadata in `peer_cards`; signature verification
+and trust reduction are future work. `auth explain` reports when a subject is
+only a discovered peer candidate and denies access.
+
 The daemon starts this endpoint during `geth daemon run` and keeps it alive for
 the daemon lifetime. When endpoint startup succeeds, the Iroh EndpointID is
 recorded as a transport binding for the stable geth node identity. If local UDP

docs/roadmap.md

@@ -101,14 +101,14 @@ geth-to-geth connections without granting trust from discovery alone.
   - Unknown ALPNs are rejected explicitly.
   - Tests cover registration collisions and unknown protocol handling.
 
-- `[ ]` Peer cards.
+- `[x]` Peer cards.
   Acceptance criteria:
   - A peer card contains node ID, agent ID, endpoint candidates, timestamp, and
     signature metadata.
   - Peer cards are stored in `peer_cards`.
   - Invalid or unsigned peer cards do not update trust state.
 
-- `[ ]` Untrusted discovery backend trait.
+- `[x]` Untrusted discovery backend trait.
   Acceptance criteria:
   - Discovery returns candidate peer cards only.
   - No discovery result grants capabilities or trust.