Enable Iroh local network discovery

docs/architecture.md

@@ -40,6 +40,10 @@ The target product should use Iroh relay support for practical internet
 connectivity and mDNS/LAN discovery for local networks. These are connectivity
 and candidate-discovery mechanisms only. They do not grant trust, mutate
 authorization state, or make EndpointID knowledge sufficient for access.
+The current daemon can enable Iroh's local-network discovery service through
+`[iroh].local_discovery = true`, which is the default. This publishes and
+discovers Iroh node addressing. Signed geth peer-card payloads over LAN
+discovery remain separate future work.
 
 Peer cards are the discovery payload. A peer card carries node ID, agent ID,
 endpoint candidates, timestamp, and signature metadata. The current scaffold

docs/roadmap.md

@@ -88,10 +88,17 @@ geth-to-geth connections without granting trust from discovery alone.
   - Status output identifies the selected custom relay map without exposing
     unrelated config.
 
-- `[ ]` LAN mDNS discovery.
+- `[x]` Iroh LAN address discovery.
   Acceptance criteria:
-  - The daemon can advertise and discover local geth peer cards over mDNS.
-  - mDNS results are stored only as untrusted peer candidates.
+  - Config can enable or disable Iroh local-network discovery.
+  - The daemon registers Iroh's local mDNS-like discovery service when enabled.
+  - `geth status --json` reports whether local-network discovery is enabled.
+
+- `[ ]` Signed peer-card LAN discovery payloads.
+  Acceptance criteria:
+  - The daemon can advertise and discover signed geth peer cards over LAN
+    discovery.
+  - LAN-discovered peer cards are stored only as untrusted peer candidates.
   - Discovered EndpointIDs do not grant module access without keychain/auth
     validation.