docs(edge-sync): document both sides of edge sync

[xe-nvdk]

Summary

Documents edge sync end to end, covering the hub receive side (Basekick-Labs/arc#570–#576) and the spoke push side (Basekick-Labs/arc#578) in one guide — an operator setting this up needs both halves.

Hub: enabling it, registering and managing spokes, secrets encrypted at rest, batch reconcile, the status codes a spoke acts on, and backend support (verify-before-commit everywhere, byte-offset resume local-only).

Spoke: the [edge_sync.spoke] block, the environment-only secret, the three operator endpoints, how to read a pass result, and scheduling it yourself until the Enterprise agent ships.

Limitations are stated, not implied

• Passes are manual in this release; the scheduled agent is Enterprise.
• Uploads are buffered, not streamed.
• Abandoned staging is not swept automatically.
• A retention policy whose database matches a spoke's namespace will delete that spoke's files — the namespace is the spoke ID, and retention operates on whatever database name it is given.
• Reconcile answers from the index rather than re-hashing storage, so hub-side corruption after a verified commit is a storage-integrity concern rather than a sync one.

Notes

• Ships alongside feat(edgesync): spoke agent and manual sync pass (#569) arc#578; the documented routes (/api/v1/spoke-sync/*) and the 400 returned on a hub_id mismatch were both verified against the shipped code rather than the design doc.

🤖 Generated with Claude Code