berth updates

berth/estate/mcrn.json

@@ -65,7 +65,7 @@
     "wireguard_moved": "superseded by the top-level `vpn` block"
   },
   "vpn": {
-    "_status": "PARTIAL — addresses and subnet verified from the live wg0 interface on nrft. Peer public keys, endpoints, allowed-ips and keepalive still need `wg show` capture on both ends (V1). Nulls below are unknowns, not defaults.",
+    "_status": "CAPTURED 2026-09-14 — public keys, allowed-ips and keepalive read from `wg show`. Roaming endpoints deliberately not recorded.",
     "_never_record": "private keys. `wg show` prints 'private key: (hidden)' and is the safe capture command. `wg showconf` dumps PrivateKey= in clear — never use it.",
     "overlays": {
       "estate": {
@@ -77,17 +77,29 @@
             "address": "10.8.0.1",
             "role": "hub",
             "note": "mcrn.ar. Has a public IP, so it is the peer others dial. Carries the registry (:5000) and woodpecker's gRPC (:9000), both bound to this address and therefore overlay-only.",
-            "endpoint": null,
-            "public_key": null,
-            "allowed_ips": null
+            "endpoint": "3.23.204.197:51820",
+            "public_key": "zVYCmi3xucuX7k/aDhrOUPyN4GRk96ffSDD6dUFQjh4=",
+            "allowed_ips": "10.8.0.0/24",
+            "keepalive": 25,
+            "listen_port": 51820
           },
           "nrft": {
             "address": "10.8.0.2",
             "role": "roaming",
             "note": "The dev box. Behind NAT, so it must initiate and needs PersistentKeepalive. Verified: wg0 UP at 10.8.0.2/24, ping 10.8.0.1 0% loss at 153ms.",
             "endpoint": null,
-            "public_key": null,
-            "allowed_ips": null,
+            "public_key": "zlIBGs4y5rt6uVdmFBasHpafht6ErxG+R3ySCg5rh3s=",
+            "allowed_ips": "10.8.0.2/32, 192.168.1.0/24",
+            "keepalive": null,
+            "listen_port": 36145
+          },
+          "work": {
+            "address": "10.8.0.3",
+            "role": "roaming",
+            "note": "A work computer, granted access when it was needed. Identified by the user at capture time, 2026-09-14 — it was NOT in the description before, and the wire is where it was found. No handshake and no transfer have ever been recorded for it, so it is a standing grant rather than a live peer: it can connect, and never has. Whether to keep or revoke it is the host's call.",
+            "endpoint": null,
+            "public_key": "ruSZwKt/p60GVsTLSAhcKBIXKkSZsf0gWSmSH1+UgE0=",
+            "allowed_ips": "10.8.0.3/32",
             "keepalive": null
           }
         }