Add SSH cert flows and user service installer

docs/architecture.md

@@ -6,6 +6,12 @@ the future shared Iroh endpoint, resource registry, module routing, and local
 control socket. Control commands connect to the Unix socket and send typed JSONL
 requests.
 
+Service management is also exposed through the single binary. `geth daemon
+service ...` installs and controls a user-level service definition for the local
+daemon. The initial backends are systemd user units on Linux, launchd user agents
+on macOS, and per-user scheduled tasks on Windows. Geth does not install itself
+as a privileged system service.
+
 ## Iroh-Only Remote Communication
 
 Remote geth node-to-node communication is Iroh-only. The daemon will own one
@@ -17,6 +23,13 @@ identities for keychain and authorization operations. SSH proxying, when added,
 will carry SSH bytes over an authorized Iroh stream and will not make SSH a geth
 transport backend.
 
+SSH certificate flows use the same split. Nodes can request new OpenSSH
+certificates or renewals through geth metadata. A machine with the CA key or
+YubiKey can approve the request and run an explicit `ssh-keygen -s ...` command,
+then import the resulting certificate for distribution. Certificate and key
+revocations are stored as signed-list-ready records and will be replicated over
+Iroh in later phases.
+
 ## Resource Model
 
 Everything meaningful is modeled as a resource. Resources have a kind, name,
@@ -42,6 +55,11 @@ are future work.
 `geth-kv`, `geth-db`, `geth-document`, `geth-pubsub`, `geth-pipe`, and
 `geth-ssh-proxy` currently define types, command shape, and roadmap stubs.
 
+`geth-ssh-identity` defines SSH trust namespaces plus certificate request,
+approval, certificate import, and revocation-list data models. The bootstrap
+persists these flows locally and exports revocations as JSONL. It does not yet
+generate OpenSSH KRL binaries or replicate the lists over Iroh.
+
 ## Keychain, Auth, And Secrets
 
 The identity plane is `geth-keychain`: admin keys, users, devices, nodes, agents,
@@ -85,4 +103,10 @@ strong forward secrecy or post-compromise security.
 - Bearer secrets are resource-scoped capabilities.
 - Bearer access does not imply trust graph mutation rights.
 - Authorization is capability-based and resource-scoped.
+- SSH certificate issuance must be explicitly approved by an authorized
+  principal before signing.
+- SSH certificate and key revocations are durable metadata that should be
+  distributed over Iroh, not fetched through unauthenticated discovery.
 - Network and control decoders treat input as untrusted.
+- Service installation targets user service managers, not system service
+  managers.