Add owner-rooted node management

docs/adr/0016-owner-node-enrollment.md

@@ -0,0 +1,42 @@
+# ADR 0016: Owner-Rooted Node Enrollment
+
+## Status
+
+Accepted.
+
+## Context
+
+Geth needs a practical device-management flow: initialize a mesh with an
+admin/owner identity, bind local daemon instances to named nodes/devices, list
+devices by name, grant resource capabilities, and revoke devices. This must not
+be a mutable device table because the project needs to evolve toward replicated
+local-first authorization.
+
+## Decision
+
+Owner and node management is represented as signed keychain operations. `geth
+init --admin-key <pub> --signing-key <key> --node-name <name>` records
+`KeychainInit`, `AdminKeyAdd`, `UserAdd`, `DeviceAdd`, `NodeAdd`, and
+`AgentBind` operations. When owner setup options are used, both `--admin-key`
+and `--signing-key` are required. Geth signs canonical keychain payloads with
+OpenSSH using the `geth.keychain.v1@geth.local` namespace.
+
+The active device list is the reduced keychain view, surfaced through `geth node
+list`. Renames and revocations are additional keychain operations. Resource
+permissions remain resource-scoped auth operations and can be managed with
+`geth node grant` and `geth node revoke-grant`.
+
+`geth keychain sync <node>` pulls keychain operations and signatures over Iroh
+from an imported peer. The receiver imports only operations with valid OpenSSH
+signatures from currently trusted admin keys over the canonical keychain
+payload. Discovery and peer cards still grant no trust by themselves.
+
+## Consequences
+
+Node names are convenience labels over stable node IDs. Endpoint rotation should
+add or revoke endpoint bindings without replacing the node identity.
+
+The current sync model is a pull-based signed operation log. It is not yet a
+Keyhive-style convergent authority, does not implement advanced group
+cryptography, and does not yet sign/verify replicated auth operations. Those are
+future roadmap items.