Description
**Doc/code drift:** the partner-network design (and downstream docs like site-types.md) describes the partner-managed guard pattern as `guard_type: partner` (generic, the correct long-term name). The hydraguard CLI / API still requires `--guard citymesh` and rejects `partner`:
```
hydraguard/pkg/api/handlers.go:497
return fmt.Errorf("invalid guard_type: must be omada, citymesh, linuxvm, or gateway")
```
Footnoted in 3 docs today (partner-network-design.md, site-types.md, citymesh-venue.md), but the underlying rename is not done.
## Fix
1. Accept `partner` as the canonical value in `pkg/api/handlers.go` validation, with `citymesh` kept as an accepted alias for back-compat with existing `mesh.yaml` files in the wild.
2. Update CLI flag help in `internal/cli/venue.go` to list `partner` first.
3. Migrate `mesh.yaml` on the Brussels hub from `citymesh` → `partner` (one-time edit; auto-backup #1 covers the rollback if needed).
4. Strip the `partner` vs `citymesh` footnote from partner-network-design.md, site-types.md, citymesh-venue.md once the code accepts the canonical name.
Keep `citymesh-venue.md` filename as-is (or rename to `partner-venue.md` — bikeshed).
## Verification
- `hydraguard venue add foo --guard partner` succeeds.
- Pre-existing entries with `guard_type: citymesh` in `mesh.yaml` still load and apply.
- All three doc footnotes can be removed.