ssh-hostcert + enrol-broker: fix defects surfaced by the F-02 bench

F-02/P-17 SSH host-cert flow was proven end-to-end on comet-beacon-54
(2026-07-11); these fix the correctness/scoping/cleanup defects the bench
surfaced:

- ssh-hostcert: derive the FQDN principal <hostname>.<domain> from the DHCP
  search domain at runtime (resolv.conf), alongside the short hostname, so an
  admin `@cert-authority *.<domain>` line accepts by-FQDN logins instead of
  "name is not a listed principal". Never baked (invariant #1). + tests.
- ssh-ca-bootstrap.sh: export the SSH host CA public key in OpenSSH wire format
  (ssh-keygen -i -m PKCS8), not the PEM/PKCS8 that `step crypto keypair` writes
  -- a PEM @cert-authority anchor is unparseable and silently falls back to TOFU.
- ssh-ca-bootstrap.sh: fail loudly (and verify enableSSHCA=true) if the
  provisioner SSH-enable step fails, instead of swallowing it and shipping a CA
  that 502s every runtime sign.
- dot1x-bench: point the co-located broker at https://localhost:8443, not the
  fleet dnsmasq name ca.fleet.lab (unresolvable from the broker's host netns ->
  "no such host" at sign time). localhost is in the CA cert SAN.
- serving: remove the mock-signer enrol-broker copy -- two host-networked
  brokers collide on 9090/9443 and the mock issued untrusted certs. The real
  broker lives with step-ca (dot1x-bench); nginx /enrol/ still proxies to it on
  loopback.
- enrol-broker: retire the HTML admin console; the fleet-manager passkey SPA now
  drives the mTLS JSON API (/pending, /approve|deny). Removes a weaker,
  client-cert-only parallel human-approve path.

Design-doc bench note deferred: docs/ssh-host-certificate-design.md lives on the
secure-ntp branch (fbb8100), not here -- to be added there / on reconcile.

serving/defaults.env

@@ -104,38 +104,13 @@ SUBNQN=nqn.2026-06.org.example.fleet:rootfs
 TARGET_PORT=4420
 SPDK_CPUMASK=0x1           # one polling core is plenty for a read-only boot fs
 
-# --- TPM enrolment broker (TEMPORARY in this stack — see docs/TODO.md #11) ---
-# The broker is the one unauthenticated pre-auth endpoint (nginx proxies /enrol/
-# to it). Defaults run the zero-dependency LAB path: a `mock` signer (ephemeral
-# CA; certs NOT trusted by RADIUS/NVMe) + plaintext loopback admin — enough to
-# exercise the request/approve/poll flow while the host side is built.
-#
-# For REAL enrolment: set ENROL_SIGNER=step, point ENROL_STEP_CA_URL at a
-# reachable step-ca (e.g. the one in serving/dot1x-bench/), drop its root +
-# provisioner password into ./enrol-pki/, generate the admin mTLS PKI
-# (./enrol-broker/admin-pki.sh ./enrol-pki/broker <admin>), and set
-# ENROL_ADMIN_INSECURE=false. Then it belongs in its own CA-co-located stack.
-ENROL_SIGNER=mock                 # mock (lab, no CA) | step (real, needs a CA)
-ENROL_ADMIN_INSECURE=true         # true = plaintext loopback admin (LAB ONLY); false = mTLS
-ENROL_PENDING_TTL=10m             # time-box on unapproved requests
-ENROL_WORDS=8                     # fingerprint word count
-ENROL_HOSTNQN_BASE=nqn.2026-06.org.example.fleet:host-
-# step signer (only when ENROL_SIGNER=step) — paths are INSIDE the container
-# (./enrol-pki is mounted at /pki):
-ENROL_STEP_CA_URL=                # e.g. https://ca.fleet.lab:8443
-ENROL_STEP_CA_ROOT=/pki/root_ca.crt
-ENROL_STEP_PROVISIONER=enrol
-ENROL_STEP_PASSWORD_FILE=/pki/password
-# Issued-cert lifetime. NOTE: the step-ca provisioner must ALLOW this — a stock
-# step-ca caps certs at 24h, so 720h is rejected ("requested duration ... more
-# than the authorized maximum certificate duration of 24h"). The bench
-# step-ca/bootstrap.sh now raises authority.claims.maxTLSCertDuration; a
-# different CA needs the same. Verified end-to-end against a real step-ca.
-ENROL_CERT_NOT_AFTER=720h
-# admin mTLS (only when ENROL_ADMIN_INSECURE=false):
-ENROL_ADMIN_CERT=/pki/broker/server.crt
-ENROL_ADMIN_KEY=/pki/broker/server.key
-ENROL_ADMIN_CLIENT_CA=/pki/broker/admin-ca.crt
+# --- TPM enrolment broker — configured in the CA-co-located stack -----------
+# The broker no longer runs in this stack (a mock-signer copy here collided with
+# the real one on 9090/9443 and issued untrusted certs — removed 2026-07-11). It
+# lives in serving/dot1x-bench/ alongside step-ca (real signing needs the CA), and
+# the `http` nginx here still proxies /enrol/ -> 127.0.0.1:9090 to reach it on the
+# same host. Configure the broker (signer, provisioner, admin mTLS) in
+# serving/dot1x-bench/.env, not here.
 
 # --- SPDK version loader / reaper (declarative rolling updates) -------------
 # The spdk-loader service stages + adds ${IMAGE_VERSION} to the long-lived target