PeerAllowPush: consent to exchange pushes, for a while, and nothing else

PeerTrust syncs a peer's pins and serves it everything - too much to
grant a stranger. An app that wants two peers sharing something (two
phones at the same place) to hand each other new content allows pushes
for ttl_secs (at most a day): both sides may push, the receiver pins,
and the allowance lapses on its own. Asking again extends it;
PeerUntrust ends it. varde-ctl peer allow-push.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

varde-ctl/src/main.rs

@@ -73,7 +73,8 @@ enum Command {
     /// Peer trust operations
     #[command(subcommand)]
     Peer(PeerCommand),
-    /// Push fully-present content to a trusted peer
+    /// Push fully-present content to a trusted peer, or one allowed to
+    /// exchange pushes
     Push {
         /// BLAKE3 hash (hex)
         hash: String,
@@ -116,6 +117,14 @@ enum PeerCommand {
         /// iroh NodeId (z-base-32)
         node_id: String,
     },
+    /// Allow pushes with a peer for a while, without trusting it
+    AllowPush {
+        /// iroh NodeId (z-base-32)
+        node_id: String,
+        /// How long, in seconds (at most a day)
+        #[arg(long, default_value_t = 1800)]
+        ttl: u64,
+    },
     /// List trusted peers
     List,
 }
@@ -187,6 +196,9 @@ fn to_request(command: Command) -> Result<Request> {
         },
         Command::Peer(PeerCommand::Trust { node_id }) => Request::PeerTrust { node_id },
         Command::Peer(PeerCommand::Untrust { node_id }) => Request::PeerUntrust { node_id },
+        Command::Peer(PeerCommand::AllowPush { node_id, ttl }) => {
+            Request::PeerAllowPush { node_id, ttl_secs: ttl }
+        }
         Command::Peer(PeerCommand::List) => Request::PeerList {},
         Command::Push { hash, node_id } => Request::Push { hash, node_id },
         Command::Gc => Request::Gc {},