Add Iroh protocol router scaffold

docs/architecture.md

@@ -27,6 +27,12 @@ material, and shuts down through `Endpoint::close().await`. The default config
 uses Iroh's default relay policy; local-only/offline development can set
 `[iroh].relay_mode = "disabled"`.
 
+Module ALPNs are registered through `geth-iroh`'s protocol router scaffold. The
+router owns the default protocol descriptors, rejects duplicate ALPN
+registrations, and returns explicit unknown-ALPN errors. It does not yet accept
+or dispatch remote streams; peer authentication and module handlers are later
+Phase 1 work.
+
 The target product should use Iroh relay support for practical internet
 connectivity and mDNS/LAN discovery for local networks. These are connectivity
 and candidate-discovery mechanisms only. They do not grant trust, mutate

docs/roadmap.md

@@ -95,7 +95,7 @@ geth-to-geth connections without granting trust from discovery alone.
   - Discovered EndpointIDs do not grant module access without keychain/auth
     validation.
 
-- `[ ]` Protocol/router scaffold.
+- `[x]` Protocol/router scaffold.
   Acceptance criteria:
   - ALPN constants are registered through one module router.
   - Unknown ALPNs are rejected explicitly.