fix: edge control stdout pollution and install.sh dispatch

- Redirect all status messages in caddy.sh to stderr (add_route, remove_route, reload_caddy)
- Redirect status message in authorized_keys.sh to stderr (rebuild_authorized_keys)
- Fix install.sh to source authorized_keys.sh library and call rebuild_authorized_keys directly

tools/edge-control/install.sh

@@ -311,7 +311,10 @@ else
 fi
 
 # Create initial authorized_keys for tunnel user
-"${INSTALL_DIR}/lib/authorized_keys.sh" rebuild_authorized_keys
+# Source the library and call the function directly (not as subprocess)
+source "${INSTALL_DIR}/lib/ports.sh"
+source "${INSTALL_DIR}/lib/authorized_keys.sh"
+rebuild_authorized_keys
 
 # =============================================================================
 # Step 6: Configure forced command for disinto-register

tools/edge-control/lib/authorized_keys.sh

@@ -85,7 +85,7 @@ rebuild_authorized_keys() {
   chmod 600 "$TUNNEL_AUTH_KEYS"
   chown -R "$TUNNEL_USER":"$TUNNEL_USER" "$TUNNEL_SSH_DIR"
 
-  echo "Rebuilt authorized_keys for ${TUNNEL_USER} (entries: $(echo "$content" | grep -c 'ssh-' || echo 0))"
+  echo "Rebuilt authorized_keys for ${TUNNEL_USER} (entries: $(echo "$content" | grep -c 'ssh-' || echo 0))" >&2
 }
 
 # Get the current authorized_keys content (for verification)

tools/edge-control/lib/caddy.sh

@@ -69,7 +69,7 @@ EOF
     return 1
   }
 
-  echo "Added route: ${fqdn} → 127.0.0.1:${port}"
+  echo "Added route: ${fqdn} → 127.0.0.1:${port}" >&2
 }
 
 # Remove a route for a project
@@ -104,7 +104,7 @@ remove_route() {
     return 1
   }
 
-  echo "Removed route: ${fqdn}"
+  echo "Removed route: ${fqdn}" >&2
 }
 
 # Reload Caddy to apply configuration changes
@@ -118,7 +118,7 @@ reload_caddy() {
     return 1
   }
 
-  echo "Caddy reloaded"
+  echo "Caddy reloaded" >&2
 }
 
 # Get Caddy config for debugging