Add protected peer auth check

AGENTS.md

@@ -106,8 +106,8 @@ Roadmap items should be actionable and checkable:
   certificate metadata, revocation metadata, user service definitions, and a
   pinned `geth-iroh` endpoint wrapper with protocol-router scaffold, peer-card
   types, manual signed peer-card export/import/list commands, `geth peer ping`
-  over Iroh, untrusted discovery-backend trait, custom relay-map config, and
-  Iroh local-network discovery toggle exist.
+  and `geth peer auth-check` over Iroh, untrusted discovery-backend trait,
+  custom relay-map config, and Iroh local-network discovery toggle exist.
 - Canonical signed-operation envelopes exist for keychain/auth signature
   payloads. The keychain reducer builds an active identity view for admin keys,
   users, devices, nodes, agents, and endpoint bindings.