Enable Holesail tunnels by default; keep holesail as required dep

Holesail is on unless ENABLE_HOLESAIL=0/false/off. The holesail package remains a required dependency; docs and UI copy match the new default.

docs/HOLESAIL.md

@@ -22,11 +22,16 @@
 **Why not replace peardock RPC with Holesail?**  
 Holesail is not an RPC framework. It tunnels bytes between TCP/UDP sockets. peardock needs structured methods, roles, audit, and pushes (stats, logs). Keep both.
 
-## Enable
+## Enable / disable
+
+Holesail tunnels are **enabled by default**. The `holesail` package is a required dependency.
 
 ```bash
-# on the peardock server host
-export ENABLE_HOLESAIL=1
+# default — tunnels on
+npm run server
+
+# opt out
+export ENABLE_HOLESAIL=0
 npm run server
 ```
 
@@ -34,7 +39,7 @@ Optional env:
 
 | Variable | Default | Meaning |
 |----------|---------|---------|
-| `ENABLE_HOLESAIL` | off | Must be `1` / `true` |
+| `ENABLE_HOLESAIL` | **on** (`1`) | Set `0` / `false` / `off` / `no` to disable |
 | `PEARDOCK_MAX_TUNNELS` | `20` | Concurrent tunnel cap |
 | `PEARDOCK_TUNNEL_HOSTS` | `127.0.0.1,localhost,::1,0.0.0.0` | Allowed tunnel targets (SSRF guard) |
 
@@ -63,7 +68,7 @@ npx holesail 'hs://s000…'
 
 ## License note
 
-`holesail` is **AGPL-3.0**. peardock remains Apache-2.0; enabling Holesail adds an AGPL dependency for servers that set `ENABLE_HOLESAIL=1`. Operators distributing a combined binary should review AGPL obligations. See `docs/SBOM.md`.
+`holesail` is **AGPL-3.0** and is a **required** peardock dependency. peardock remains Apache-2.0; shipping peardock includes Holesail under AGPL. Operators distributing a combined binary should review AGPL obligations. See `docs/SBOM.md`. Set `ENABLE_HOLESAIL=0` if you must run without opening tunnels (package still installed).
 
 ## Security
 

docs/OPERATOR.md

@@ -61,7 +61,7 @@ Vault file: `peardock-vault.json` (mode 600). Override path with `PEARDOCK_VAULT
 |-----|--------|
 | `ENABLE_SWARM=1` | Swarm / services / secrets / configs RPC |
 | `ENABLE_PLUGINS=1` | Plugin install/enable/remove |
-| `ENABLE_HOLESAIL=1` | Holesail P2P port tunnels (`hs://` keys) — see [HOLESAIL.md](./HOLESAIL.md) |
+| `ENABLE_HOLESAIL=0` | Disable Holesail P2P port tunnels (on by default) — see [HOLESAIL.md](./HOLESAIL.md) |
 | `PEARDOCK_MAX_TUNNELS` | Max concurrent Holesail tunnels (default 20) |
 | `PEARDOCK_TUNNEL_HOSTS` | Extra allowed tunnel target hosts (comma-separated) |
 | `PEARDOCK_UNRESTRICTED_CLI=1` | Broader `docker` CLI for **admin** |

docs/SBOM.md

@@ -27,7 +27,7 @@ See `package.json` / `package-lock.json`. Major surface:
 | graceful-goodbye | Shutdown |
 | hypercore-crypto | Key material |
 | pear-electron / pear-bridge | Desktop shell |
-| holesail | Optional P2P TCP/UDP tunnels (`ENABLE_HOLESAIL=1`) — **AGPL-3.0** |
+| holesail | Required P2P TCP/UDP tunnels (on by default; `ENABLE_HOLESAIL=0` to disable) — **AGPL-3.0** |
 
 ## Known-sensitive native deps
 

docs/THREAT_MODEL.md

@@ -31,7 +31,7 @@
 - **Anyone with the server public key** can *attempt* a DHT connection.
 - **Default role is admin** unless `PEARDOCK_DEFAULT_ROLE` / `PEARDOCK_ADMIN_KEYS` / peer policy tighten it.
 - **Swarm / plugins** are off unless `ENABLE_SWARM` / `ENABLE_PLUGINS`.
-- **Holesail tunnels** are off unless `ENABLE_HOLESAIL=1` — each `hs://` URL is a capability to the target port.
+- **Holesail tunnels** are on by default (`ENABLE_HOLESAIL=0` to disable) — each `hs://` URL is a capability to the target port.
 - **Host FS browse** is **default-deny** unless `PEARDOCK_BROWSE_ROOTS` or `PEARDOCK_BROWSE_OPEN=1`.
 
 ---
@@ -57,7 +57,7 @@
 | Rate limit | Per-peer limiter on RPC |
 | Registry secrets | AES-256-GCM vault (`registry-vault.js`) |
 | Browse FS | Root allowlist / default deny |
-| Feature gates | `ENABLE_SWARM`, `ENABLE_PLUGINS`, `ENABLE_HOLESAIL`, `PEARDOCK_UNRESTRICTED_CLI` |
+| Feature gates | `ENABLE_SWARM`, `ENABLE_PLUGINS`, `ENABLE_HOLESAIL` (default on; set `0` to disable), `PEARDOCK_UNRESTRICTED_CLI` |
 | Tunnel targets | Loopback / allowlisted hosts only (`PEARDOCK_TUNNEL_HOSTS`) |
 
 ---