feat(partnership): add blocklist to block access after offboard

After offboard, the former partner's hostname is written to
/boot/config/partnership_blocklist.db. This blocks passive reconnection:
  - --check skips the remote entirely (no auto-reconnect noise)
  - rsync.sh refuses to sync with a blocklisted host
  - --onboard warns about the previous offboard but proceeds,
    and clears the block on success (onboard = deliberate intent)

New --unblock <hostname> mode removes an entry to permit re-onboarding
without running a full --onboard first. --status shows the full blocklist.

Blocklist file survives reboots (/boot/config) and Tailscale reconnections —
application-layer guard that complements Tailscale device removal.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Rsync/rsync.sh

@@ -107,6 +107,14 @@ if ! check_rsync_enabled; then
     exit 0
 fi
 
+# Blocklist gate — refuse to sync with a partner blocked after offboard
+BLOCKLIST_FILE="/boot/config/partnership_blocklist.db"
+if [[ -f "$BLOCKLIST_FILE" ]] && grep -q "^${REMOTE_SERVER_NAME}|" "$BLOCKLIST_FILE" 2>/dev/null; then
+    error "Rsync blocked — $REMOTE_SERVER_NAME is on the partnership blocklist"
+    error "Re-onboard the partnership to restore access: partnership_manager.sh --onboard"
+    exit 1
+fi
+
 resolve_remote_ip
 
 # ── Profile inference ─────────────────────────────────────────────────────────────────────────