ssh-hostcert + enrol-broker: fix defects surfaced by the F-02 bench

F-02/P-17 SSH host-cert flow was proven end-to-end on comet-beacon-54
(2026-07-11); these fix the correctness/scoping/cleanup defects the bench
surfaced:

- ssh-hostcert: derive the FQDN principal <hostname>.<domain> from the DHCP
  search domain at runtime (resolv.conf), alongside the short hostname, so an
  admin `@cert-authority *.<domain>` line accepts by-FQDN logins instead of
  "name is not a listed principal". Never baked (invariant #1). + tests.
- ssh-ca-bootstrap.sh: export the SSH host CA public key in OpenSSH wire format
  (ssh-keygen -i -m PKCS8), not the PEM/PKCS8 that `step crypto keypair` writes
  -- a PEM @cert-authority anchor is unparseable and silently falls back to TOFU.
- ssh-ca-bootstrap.sh: fail loudly (and verify enableSSHCA=true) if the
  provisioner SSH-enable step fails, instead of swallowing it and shipping a CA
  that 502s every runtime sign.
- dot1x-bench: point the co-located broker at https://localhost:8443, not the
  fleet dnsmasq name ca.fleet.lab (unresolvable from the broker's host netns ->
  "no such host" at sign time). localhost is in the CA cert SAN.
- serving: remove the mock-signer enrol-broker copy -- two host-networked
  brokers collide on 9090/9443 and the mock issued untrusted certs. The real
  broker lives with step-ca (dot1x-bench); nginx /enrol/ still proxies to it on
  loopback.
- enrol-broker: retire the HTML admin console; the fleet-manager passkey SPA now
  drives the mTLS JSON API (/pending, /approve|deny). Removes a weaker,
  client-cert-only parallel human-approve path.

Design-doc bench note deferred: docs/ssh-host-certificate-design.md lives on the
secure-ntp branch (fbb8100), not here -- to be added there / on reconcile.

serving/dot1x-bench/docker-compose.yml

@@ -70,7 +70,12 @@ services:
       BROKER_PUBLIC_ADDR: "127.0.0.1:9090"
       BROKER_ADMIN_ADDR: "127.0.0.1:9443"
       BROKER_SIGNER: "step"
-      STEP_CA_URL: "https://${CA_DNS:-ca.fleet.lab}:${CA_PORT:-8443}"
+      # Co-located with step-ca (both network_mode: host), so reach it over
+      # loopback — NOT the fleet DNS name. ca.fleet.lab is a dnsmasq name for
+      # boot-LAN clients; the broker's host resolver doesn't know it, so signing
+      # died with "lookup ca.fleet.lab: no such host" (bench 2026-07-11). localhost
+      # is always in the CA cert SAN (DOCKER_STEPCA_INIT_DNS_NAMES) so TLS verifies.
+      STEP_CA_URL: "https://localhost:${CA_PORT:-8443}"
       STEP_CA_ROOT: "/pki/root_ca.crt"
       STEP_PROVISIONER: "enrol"
       STEP_PROVISIONER_PASSWORD_FILE: "/pki/stepca/secrets/password"

serving/dot1x-bench/step-ca/ssh-ca-bootstrap.sh

@@ -82,10 +82,33 @@ fi
 # The broker authenticates to step-ca with this JWK provisioner (signer.go). It
 # must be allowed to issue SSH HOST certs. BENCH-VERIFY the exact subcommand/flag
 # on your step version (some use `provisioner update <name> --ssh`).
-echo "==> enabling SSH on provisioner '${PROVISIONER}' (BENCH-VERIFY the flag)"
-incca step ca provisioner update "${PROVISIONER}" --ssh 2>/dev/null \
-  && restart_ca \
-  || echo "   NOTE: could not auto-enable SSH on '${PROVISIONER}' — enable it by hand (step ca provisioner update ${PROVISIONER} --ssh) and restart step-ca."
+echo "==> enabling SSH host-cert issuance on provisioner '${PROVISIONER}'"
+# FAIL LOUDLY: a swallowed failure here leaves enableSSHCA=false, and every
+# `step ssh certificate` at runtime dies with a 502 whose cause the operator
+# can't see (bench 2026-07-11). If your `step` uses a different flag, fix it and
+# re-run rather than shipping a half-configured CA.
+if ! incca step ca provisioner update "${PROVISIONER}" --ssh; then
+  echo "ERROR: 'step ca provisioner update ${PROVISIONER} --ssh' failed. Your step" >&2
+  echo "       version may use a different flag — check: step ca provisioner update --help" >&2
+  echo "       Aborting so SSH host-cert signing isn't silently left disabled." >&2
+  exit 1
+fi
+restart_ca
+# Verify it actually took — the CA only issues SSH host certs if enableSSHCA=true.
+if ! python3 - "$CA_JSON" "$PROVISIONER" <<'PY'
+import json,sys
+c=json.load(open(sys.argv[1])); name=sys.argv[2]
+for p in c["authority"]["provisioners"]:
+    if p.get("name")==name and p.get("claims",{}).get("enableSSHCA") is True:
+        sys.exit(0)
+sys.exit(1)
+PY
+then
+  echo "ERROR: provisioner '${PROVISIONER}' still not SSH-enabled (enableSSHCA != true)" >&2
+  echo "       after the update + restart. SSH host-cert signing would fail at runtime; aborting." >&2
+  exit 1
+fi
+echo "   SSH host-cert issuance enabled on '${PROVISIONER}' (enableSSHCA=true)."
 
 # --- 3. broker host-plane server cert + fleet client-CA bundle --------------
 # The host plane is mTLS: its SERVER cert must be FLEET-signed (the booted host
@@ -104,8 +127,19 @@ cat "$PKI/root_ca.crt" > "$PKI/broker/fleet-client-ca.crt"
 [ -f "$PKI/intermediate_ca.crt" ] && cat "$PKI/intermediate_ca.crt" >> "$PKI/broker/fleet-client-ca.crt"
 
 # --- 4. export the SSH host CA public key (admin trust anchor) ---------------
-echo "==> exporting SSH host CA public key -> $PKI/ssh_host_ca.pub"
-incca cp /home/step/secrets/ssh_host_ca_key.pub /export/ssh_host_ca.pub
+# `step crypto keypair` writes the public key in PEM/PKCS8, but a known_hosts
+# `@cert-authority` line needs the single-line OpenSSH wire format
+# (`ecdsa-sha2-nistp256 AAAA…`). Emitting the PEM verbatim yields an unparseable
+# anchor → ssh silently falls back to TOFU (bench 2026-07-11). Convert it.
+echo "==> exporting SSH host CA public key (OpenSSH format) -> $PKI/ssh_host_ca.pub"
+incca cp /home/step/secrets/ssh_host_ca_key.pub /export/ssh_host_ca_key.pem
+command -v ssh-keygen >/dev/null 2>&1 || {
+  echo "ERROR: ssh-keygen not found — cannot convert the CA key to OpenSSH format." >&2
+  echo "       Install openssh-clients; the raw PKCS8 key is at $PKI/ssh_host_ca_key.pem." >&2
+  exit 1
+}
+ssh-keygen -i -m PKCS8 -f "$PKI/ssh_host_ca_key.pem" > "$PKI/ssh_host_ca.pub"
+rm -f "$PKI/ssh_host_ca_key.pem"
 echo
 echo "Admin rollout — add ONE line to each admin's ~/.ssh/known_hosts (or a system"
 echo "known_hosts), so every fleet host is trusted via the CA instead of TOFU:"