bootstrap: enable netbird ssh-jwt-cache-ttl on workstation enrollment

After preflight detects MESH_CONNECTED=netbird, run `netbird down && netbird up
--ssh-jwt-cache-ttl=86400` so ssh into mesh peers (e.g. `ssh -p 22022
root@proxmox-server.netbird.selfhosted ...`) stops triggering device-code SSO
on every connection.

Validated 2026-05-21 on republic-laptop: after one SSO, subsequent ssh
sessions within 24h skip the device-code flow and run instantly. Fleet
operations (e.g. pct exec through hubris into LXCs) reuse the cached JWT.

Notes:
- Flag is supported in netbird 0.71.x+ (netbirdio/netbird#4015). A version
  probe (`netbird up --help | grep ssh-jwt-cache-ttl`) skips the section on
  older clients.
- Flag belongs on `netbird up` (client config), NOT on the daemon's
  ExecStart — putting it there crashes the daemon with "unknown flag".
- Runs LAST in bootstrap, after secrets issuance + MCP wiring, so the brief
  mesh down/up doesn't disrupt earlier steps.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

bootstrap.sh

@@ -325,6 +325,28 @@ PYEOF
     fi
 fi
 
+# -------- netbird tuning (skip per-session SSO for ssh into mesh peers) --------
+# Apply the SSH JWT cache TTL so `ssh ... .netbird.selfhosted` doesn't trigger
+# device-code SSO on every connection. Flag added in netbird 0.71.x
+# (netbirdio/netbird#4015). It belongs on `netbird up` — putting it on the
+# daemon's ExecStart crashes the daemon with "unknown flag". After this runs the
+# FIRST ssh still prompts SSO once; subsequent sessions within 24h skip it.
+if [ "$MESH_CONNECTED" = "netbird" ]; then
+    if [ "$DRY_RUN" -eq 1 ]; then
+        echo "+ would: netbird down && netbird up --ssh-jwt-cache-ttl=86400"
+    elif netbird up --help 2>&1 | grep -q -- "--ssh-jwt-cache-ttl"; then
+        echo "[bootstrap] netbird: enabling ssh-jwt-cache-ttl=86400 (one SSO per 24h)"
+        # `netbird up` short-circuits with "Already connected" — need down first.
+        netbird down >/dev/null 2>&1 || true
+        if ! netbird up --ssh-jwt-cache-ttl=86400; then
+            echo "[bootstrap] WARNING: netbird up with --ssh-jwt-cache-ttl failed; rerun manually:"
+            echo "[bootstrap]   netbird down && netbird up --ssh-jwt-cache-ttl=86400"
+        fi
+    else
+        echo "[bootstrap] netbird: --ssh-jwt-cache-ttl flag not supported (need >=0.71.x); skipping"
+    fi
+fi
+
 # -------- done --------
 cat <<EOF