ssh-hostcert + enrol-broker: fix defects surfaced by the F-02 bench

F-02/P-17 SSH host-cert flow was proven end-to-end on comet-beacon-54
(2026-07-11); these fix the correctness/scoping/cleanup defects the bench
surfaced:

- ssh-hostcert: derive the FQDN principal <hostname>.<domain> from the DHCP
  search domain at runtime (resolv.conf), alongside the short hostname, so an
  admin `@cert-authority *.<domain>` line accepts by-FQDN logins instead of
  "name is not a listed principal". Never baked (invariant #1). + tests.
- ssh-ca-bootstrap.sh: export the SSH host CA public key in OpenSSH wire format
  (ssh-keygen -i -m PKCS8), not the PEM/PKCS8 that `step crypto keypair` writes
  -- a PEM @cert-authority anchor is unparseable and silently falls back to TOFU.
- ssh-ca-bootstrap.sh: fail loudly (and verify enableSSHCA=true) if the
  provisioner SSH-enable step fails, instead of swallowing it and shipping a CA
  that 502s every runtime sign.
- dot1x-bench: point the co-located broker at https://localhost:8443, not the
  fleet dnsmasq name ca.fleet.lab (unresolvable from the broker's host netns ->
  "no such host" at sign time). localhost is in the CA cert SAN.
- serving: remove the mock-signer enrol-broker copy -- two host-networked
  brokers collide on 9090/9443 and the mock issued untrusted certs. The real
  broker lives with step-ca (dot1x-bench); nginx /enrol/ still proxies to it on
  loopback.
- enrol-broker: retire the HTML admin console; the fleet-manager passkey SPA now
  drives the mTLS JSON API (/pending, /approve|deny). Removes a weaker,
  client-cert-only parallel human-approve path.

Design-doc bench note deferred: docs/ssh-host-certificate-design.md lives on the
secure-ntp branch (fbb8100), not here -- to be added there / on reconcile.

serving/enrol-broker/README.md

@@ -19,7 +19,7 @@ PUBLIC  (plain HTTP, behind the serving nginx /enrol/)   UNAUTHENTICATED
   GET  /healthz
 
 ADMIN   (mTLS, management network / loopback ONLY)        admin client cert
-  GET  /              the pending-queue web UI (fingerprint + approve/deny)
+  GET  /              plaintext pointer (API only; human UI is the fleet-manager SPA)
   GET  /pending       JSON queue
   POST /approve/{id}  OOB-approve -> step ca sign -> store cert
   POST /deny/{id}     reject
@@ -74,9 +74,11 @@ docker compose up -d step-ca && ./step-ca/bootstrap.sh   # CA + root_ca.crt + en
 docker compose up -d enrol-broker
 ```
 
-Then import `pki/broker/clients/alice.p12` (empty password) into your browser and
-open `https://127.0.0.1:9443/`. Hosts reach the public side via the serving
-stack's nginx: `http://boot.fleet.lab/enrol/`.
+Approve/deny is driven by the **fleet-manager SPA** (passkey-gated), which calls
+this plane's JSON API over mTLS; the broker no longer serves its own HTML console.
+For a scripted/manual approve, use the admin client cert directly against the API,
+e.g. `curl --cert/--key … https://127.0.0.1:9443/pending`. Hosts reach the public
+side via the serving stack's nginx: `http://boot.fleet.lab/enrol/`.
 
 ### Admin mTLS PKI — important