fleet-manager: fix nonroot data-volume ownership + document broker wiring

The distroless nonroot runtime (uid 65532) couldn't write /data/inventory.json
because a named volume is created root-owned — approve failed with permission
denied on the inventory birth. Pre-create /data owned by nonroot in the image so
a fresh volume inherits it via Docker copy-up; an already-created root-owned
volume still needs a one-time chown (documented).

DEPLOY.md:
- 2b now covers BOTH broker deployments — the main serving stack
  (enrol-pki/broker, ENROL_ADMIN_INSECURE=true by default → must flip to false)
  and the bench stack — with the mint-once-into-broker-dir, copy-CA-to-manager
  flow and an mTLS verify curl.
- Troubleshooting section: the data-volume permission-denied fix, the
  "authorise plane not configured" (recreate + single-instance) fix, and the
  "wrong version number" (broker plaintext) fix.

serving/fleet-manager/Dockerfile

@@ -8,7 +8,7 @@
 #   docker build -t fleet-manager serving/fleet-manager
 
 # ---- 1. build the SPA ------------------------------------------------------
-FROM node:24-alpine AS ui
+FROM harbor.bitasylum.org/dockerhub/library/node:24-alpine AS ui
 WORKDIR /ui
 COPY ui/package.json ui/package-lock.json ./
 RUN npm ci --no-audit --no-fund
@@ -16,7 +16,7 @@ COPY ui/ ./
 RUN npm run build          # -> /ui/dist
 
 # ---- 2. build the Go binary (SPA embedded) --------------------------------
-FROM golang:1.26-alpine AS build
+FROM harbor.bitasylum.org/dockerhub/library/golang:1.26-alpine AS build
 WORKDIR /src
 COPY go.mod go.sum ./
 RUN go mod download
@@ -25,11 +25,19 @@ COPY --from=ui /ui/dist ./ui/dist
 ENV CGO_ENABLED=0 GOTOOLCHAIN=local
 RUN go build -tags embedspa -trimpath -buildvcs=false \
       -ldflags '-s -w -buildid=' -o /fleet-manager .
+# Seed dir whose ownership a FRESH named volume inherits via Docker's copy-up, so
+# the nonroot runtime (uid 65532) can write inventory/admins/enroll.key under
+# /data without a manual chown. (An ALREADY-created root-owned volume must still
+# be chowned or recreated once — see DEPLOY.md.)
+RUN mkdir -p /data-seed && touch /data-seed/.keep
 
 # ---- 3. minimal runtime ----------------------------------------------------
 # distroless/static: static binary + ca-certificates + tzdata, non-root by
-# default. The data dir (inventory + admin store) is a mounted, writable volume.
+# default (uid 65532). The data dir (inventory + admin store + enrol key) is a
+# mounted, writable volume — pre-created here owned by nonroot so a fresh volume
+# inherits that ownership.
 FROM gcr.io/distroless/static-debian12:nonroot
 COPY --from=build /fleet-manager /usr/local/bin/fleet-manager
+COPY --from=build --chown=65532:65532 /data-seed /data
 USER nonroot:nonroot
 ENTRYPOINT ["/usr/local/bin/fleet-manager"]