feat(node): auto-bootstrap ssh during pair and add ssh setup command

Author: roodboi

docs/cli.md

@@ -749,6 +749,7 @@ Subcommands:
 | --- | --- |
 | `init` | Initialize this host as a node and emit enrollment bundle |
 | `pair` | Pair node with one-command or expiring verification-code flow |
+| `ssh` | Manage SSH bootstrap for node pairing and remote runs |
 | `add` | Add a node from an enrollment bundle |
 | `list` | List registered nodes |
 | `status` | Probe node health and report live status |
@@ -787,6 +788,9 @@ hack node pair complete --session <pair-session-id> --bundle approved-bundle.jso
 # controller one-shot approve + complete for existing pending request
 hack node pair fulfill --session <pair-session-id> --code <one-time-code> --default
 
+# repair/setup passwordless SSH explicitly (also run automatically by `hack node pair`)
+hack node ssh setup --source "remote-user@node-a.tailnet.ts.net"
+
 # on controller
 hack node add --bundle ./node-bundle.json
 hack node list

docs/guides/remote-node-laptop-e2e.md

@@ -82,8 +82,10 @@ Notes:
    - `/usr/local/bin/hack`
    - `/usr/bin/hack`
    - `PATH` fallback (`which hack`)
-2. If endpoint inference fails, pass `--endpoint` explicitly.
-3. If SSH username was wrong, retry with the correct user.
+2. `hack node pair` also auto-runs SSH bootstrap (managed key + `~/.ssh/config` host block) so remote runs can use non-interactive SSH.
+3. If you need to repair SSH independently, run `hack node ssh setup --source "<user@node-host>"`.
+4. If endpoint inference fails, pass `--endpoint` explicitly.
+5. If SSH username was wrong, retry with the correct user.
 
 Validate:
 

docs/guides/remote-node-quickstart.md

@@ -34,6 +34,13 @@ hack node pair \
   --default
 ```
 
+`hack node pair` now auto-bootstraps passwordless SSH for the provided source.
+If you need to repair SSH outside pairing, run:
+
+```bash
+hack node ssh setup --source "<user@remote-host>"
+```
+
 Validate:
 
 ```bash