Add protected peer auth check

README.md

@@ -77,6 +77,7 @@ The bootstrap implementation provides:
 - `geth peer import <path>`
 - `geth peer list`
 - `geth peer ping <node-id>`
+- `geth peer auth-check <node-id> <resource> <capability>`
 - `geth resource list`
 - `geth resource create <kind> <name>`
 - `geth keychain init [--admin-key <path>]`
@@ -121,6 +122,9 @@ The bootstrap implementation provides:
 include the Iroh EndpointID plus currently known relay/direct addresses.
 `geth peer ping <node-id>` uses the local daemon's Iroh endpoint to dial an
 imported peer card and exchange a signed candidate-only peer-card ping.
+`geth peer auth-check <node-id> <resource> <capability>` sends a protected
+Iroh control request: the remote daemon verifies that the caller's signed peer
+card binds the actual Iroh EndpointID before reducing resource-local auth ops.
 Importing or pinging a peer card never grants capabilities by itself.
 
 Other command groups exist as explicit stubs: `ssh proxy`.