fleet-manager: actionable error when the enrol key is missing at startup

Flipping FLEET_MGR_ADMIN_INSECURE=false before bootstrapping an admin crash-looped
on a cryptic "enrol key: open /data/enroll.key: no such file or directory". The
key is created by `register-admin`, so on ErrNotExist say exactly that (and note
the insecure escape hatch) instead of surfacing the raw errno.

serving/fleet-manager/cli.go

@@ -18,6 +18,7 @@ import (
 	"crypto/subtle"
 	"encoding/base64"
 	"encoding/hex"
+	"errors"
 	"flag"
 	"fmt"
 	"os"
@@ -87,6 +88,11 @@ func loadEnrollKey(path string) ([]byte, error) {
 		return nil, fmt.Errorf("no enrol key file configured (FLEET_MGR_ENROLL_KEY_FILE)")
 	}
 	b, err := os.ReadFile(path)
+	if errors.Is(err, os.ErrNotExist) {
+		// The key is created by the admin bootstrap — a fresh secure-mode start
+		// before any admin exists lands here. Point at the fix, not the errno.
+		return nil, fmt.Errorf("enrol key %s not found — bootstrap the admin plane first: `fleet-manager register-admin <name>` (or set FLEET_MGR_ADMIN_INSECURE=true for dev)", path)
+	}
 	if err != nil {
 		return nil, err
 	}