enrol-broker: run in serving stack + fix step signer path end-to-end

Verifying the step signer against a real step-ca surfaced two real bugs the
mock signer had hidden, plus made the bench CA actually initialise:

- signer.go: move --not-after from `step ca token` (validity caps ~1h ->
  "token validity too long") to `step ca sign` (it is the CERT lifetime).
  Without this the step signer never issues a cert.
- dot1x-bench compose: DOCKER_STEPCA_INIT_PASSWORD_FILE pointed at a file that
  does not exist at first init (it is an INPUT path), so `step ca init` failed
  and never wrote secrets/password. Use DOCKER_STEPCA_INIT_PASSWORD (the value)
  which the entrypoint writes to secrets/password, where bootstrap + broker read.
- bootstrap.sh: self-heal the root-owned ./pki Docker auto-creates; detect the
  CA password at $STEPPATH/password or secrets/password (varies by image
  version); raise authority.claims.maxTLSCertDuration so 720h fleet certs are
  allowed (stock cap 24h, which also blocked bootstrap's own RADIUS cert); fix
  RADIUS cert paths to write via the /export mount (were host paths run inside
  the container, so they never resolved).

- serving stack: add the enrol-broker service (temporary home; nginx already
  proxies /enrol/) defaulting to the zero-dependency lab path (mock signer +
  insecure loopback admin), with ENROL_* knobs to switch to step + mTLS.
- verify-serving.sh: exercise request -> approve -> cert through the deployed
  nginx /enrol/ proxy.
- TODO #11: record the step-signer verification + the two fixes.

Step signer VERIFIED end-to-end against a real step-ca: issued cert chains to
the fleet root, EKU clientAuth, hostnqn derived from serial.

docs/TODO.md

@@ -1003,6 +1003,32 @@ authenticates EAP-TLS. **REMAINING:** the host-side inline empty-NV dracut branc
 (generate key/CSR → POST → Plymouth fingerprint → poll → NV write → reboot) +
 `tpm2-openssl` in the image.
 
+**TEMPORARY (2026-06-28): broker also added to the MAIN serving stack**
+(`serving/docker-compose.yml`, `enrol-broker` service + `ENROL_*` in
+`serving/.env.example`) so a single `compose up` in `serving/` brings the
+`/enrol/` endpoint up while the host side is built. Defaults to the
+zero-dependency lab path — **`mock` signer** (ephemeral CA; certs NOT trusted by
+RADIUS/NVMe) + **plaintext loopback admin** (`ENROL_ADMIN_INSECURE=true`). The
+serving nginx already proxies `/enrol/`→`127.0.0.1:9090`. **SPLIT BACK OUT:** the
+broker's proper home is a CA-co-located stack (it's still defined in
+`dot1x-bench/` next to step-ca); real signing needs the fleet CA. Don't run both
+copies on one host (they collide on 9090/9443). To use real signing from the
+serving stack meanwhile: set `ENROL_SIGNER=step` + `ENROL_STEP_CA_URL` at a
+reachable step-ca, populate `serving/enrol-pki/`, and `ENROL_ADMIN_INSECURE=false`.
+
+**STEP SIGNER VERIFIED end-to-end 2026-06-28** (broker → real step-ca → signed
+cert that chains to the fleet root; hostnqn derived from serial; EKU clientAuth).
+Verification found + fixed two things the `mock` path had hidden:
+- **BUG FIXED (`signer.go`):** `--not-after` was passed to `step ca token`
+  (validity capped ~1h → "token validity too long") instead of `step ca sign`.
+  Moved to the sign step. Without it the step signer never issues a cert.
+- **CA CLAIM REQUIRED:** a stock step-ca caps certs at 24h, so 720h is rejected
+  ("authorized maximum certificate duration of 24h"). `dot1x-bench/step-ca/bootstrap.sh`
+  now raises `authority.claims.maxTLSCertDuration` (+restarts the CA) — this also
+  unblocks bootstrap's own 720h RADIUS cert. Any other CA needs the same claim.
+- **BENCH-VERIFY still open:** issued cert actually authenticates EAP-TLS through
+  FreeRADIUS (next, before host enrolment).
+
 How a host gets its **802.1X EAP-TLS client identity** the first time — the key at
 TPM handle `0x81010001` + cert at NV `0x01800001` that invariant #1 says must come
 from enrolment, never the image. Distinct from #10 (that enrols *Secure Boot*