Add resource-scoped bearer access metadata

AGENTS.md

@@ -126,8 +126,9 @@ Roadmap items should be actionable and checkable:
 - Document resources can be registered locally with empty JSON state and
   local-only status. Automerge editing/state and sync are still roadmap work.
 - Resource secret epoch metadata can be created, rotated, and listed locally.
-  Payload encryption, key envelopes, and bearer invite enforcement are still
-  roadmap work.
+  Bearer access metadata can be created/listed/revoked as resource-scoped auth
+  ops and must not allow trust graph mutation capabilities. Payload encryption,
+  key envelopes, and bearer challenge-response are still roadmap work.
 - Signed peer-card LAN discovery payloads, peer auth over Iroh, cr-sqlite,
   iroh-docs, iroh-gossip, iroh-blobs, Automerge sync, real auth enforcement,
   OpenSSH KRL generation, and Keyhive/BeeKEM-style authorization are future