docs: SSH-based bulk sync and peer queries, spatial extension

Replace object-store replication with rsync over persistent multiplexed
SSH (ed25519, pinned known_hosts, forced commands as the only remote
API); demote GraphQL to the ground integration standard. Add DuckDB
spatial extension for separation audits, perimeter predicates and
trajectory analysis in the local planar frame.

docs/00-glossary.md

@@ -14,6 +14,7 @@ Terms and abbreviations used throughout this proposal.
 | **Hot / warm / cold tiers** | Storage floors ordered by access latency and retention: in-memory window → local NVMe → ground warehouse |
 | **Sealing** | Compacting many small streamed Parquet files into one final file per partition once a time window closes |
 | **UUIDv7** | Time-ordered UUID; sortable by creation time, used as the canonical flight identifier |
+| **DuckDB spatial** | Extension adding a GEOMETRY type and `ST_*` functions; used for separation audits, perimeter predicates, and trajectory analysis in the local planar frame |
 | **Schema registry** | Versioned catalog of dataset schemas so producers and consumers can evolve independently |
 | **ETL** | Extract, transform, load — the pipelines that move and reshape data between tiers |
 
@@ -45,6 +46,9 @@ Terms and abbreviations used throughout this proposal.
 | **On-prem** | Runs on owned hardware; no public cloud involvement |
 | **Zero trust** | No implicit trust from network position; every peer authenticates with pre-provisioned credentials |
 | **mTLS** | Mutual TLS — both sides of a connection present certificates |
+| **ed25519** | Modern elliptic-curve signature scheme; the SSH key type provisioned per device and per operation |
+| **Forced command** | `command="…"` restriction in `authorized_keys`: the key can execute exactly one predefined operation — the key *is* the API |
+| **ControlMaster** | SSH connection multiplexing: one persistent authenticated session carries many transfers/commands |
 | **PKI** | Public key infrastructure — the certificate authority hierarchy behind mTLS |
 | **WireGuard** | Lightweight encrypted tunnel protocol; basis for the swarm mesh overlay |
 | **Ad-hoc mesh** | Wireless network formed directly between peers, no fixed infrastructure |