VM130: ops@router-ops
VM101 approved route: VM130 -> ssh pve-mgts -> root@10.71.100.2 using /root/.ssh/pve_to_openwrt_mgts_ed25519
R06 uses the route read-only for authoritative post-check only.