enrol-broker: run in serving stack + fix step signer path end-to-end

Verifying the step signer against a real step-ca surfaced two real bugs the
mock signer had hidden, plus made the bench CA actually initialise:

- signer.go: move --not-after from `step ca token` (validity caps ~1h ->
  "token validity too long") to `step ca sign` (it is the CERT lifetime).
  Without this the step signer never issues a cert.
- dot1x-bench compose: DOCKER_STEPCA_INIT_PASSWORD_FILE pointed at a file that
  does not exist at first init (it is an INPUT path), so `step ca init` failed
  and never wrote secrets/password. Use DOCKER_STEPCA_INIT_PASSWORD (the value)
  which the entrypoint writes to secrets/password, where bootstrap + broker read.
- bootstrap.sh: self-heal the root-owned ./pki Docker auto-creates; detect the
  CA password at $STEPPATH/password or secrets/password (varies by image
  version); raise authority.claims.maxTLSCertDuration so 720h fleet certs are
  allowed (stock cap 24h, which also blocked bootstrap's own RADIUS cert); fix
  RADIUS cert paths to write via the /export mount (were host paths run inside
  the container, so they never resolved).

- serving stack: add the enrol-broker service (temporary home; nginx already
  proxies /enrol/) defaulting to the zero-dependency lab path (mock signer +
  insecure loopback admin), with ENROL_* knobs to switch to step + mTLS.
- verify-serving.sh: exercise request -> approve -> cert through the deployed
  nginx /enrol/ proxy.
- TODO #11: record the step-signer verification + the two fixes.

Step signer VERIFIED end-to-end against a real step-ca: issued cert chains to
the fleet root, EKU clientAuth, hostnqn derived from serial.

serving/.env.example

@@ -85,6 +85,39 @@ SUBNQN=nqn.2026-06.org.example.fleet:rootfs
 TARGET_PORT=4420
 SPDK_CPUMASK=0x1           # one polling core is plenty for a read-only boot fs
 
+# --- TPM enrolment broker (TEMPORARY in this stack — see docs/TODO.md #11) ---
+# The broker is the one unauthenticated pre-auth endpoint (nginx proxies /enrol/
+# to it). Defaults run the zero-dependency LAB path: a `mock` signer (ephemeral
+# CA; certs NOT trusted by RADIUS/NVMe) + plaintext loopback admin — enough to
+# exercise the request/approve/poll flow while the host side is built.
+#
+# For REAL enrolment: set ENROL_SIGNER=step, point ENROL_STEP_CA_URL at a
+# reachable step-ca (e.g. the one in serving/dot1x-bench/), drop its root +
+# provisioner password into ./enrol-pki/, generate the admin mTLS PKI
+# (./enrol-broker/admin-pki.sh ./enrol-pki/broker <admin>), and set
+# ENROL_ADMIN_INSECURE=false. Then it belongs in its own CA-co-located stack.
+ENROL_SIGNER=mock                 # mock (lab, no CA) | step (real, needs a CA)
+ENROL_ADMIN_INSECURE=true         # true = plaintext loopback admin (LAB ONLY); false = mTLS
+ENROL_PENDING_TTL=10m             # time-box on unapproved requests
+ENROL_WORDS=8                     # fingerprint word count
+ENROL_HOSTNQN_BASE=nqn.2026-06.org.example.fleet:host-
+# step signer (only when ENROL_SIGNER=step) — paths are INSIDE the container
+# (./enrol-pki is mounted at /pki):
+ENROL_STEP_CA_URL=                # e.g. https://ca.fleet.lab:8443
+ENROL_STEP_CA_ROOT=/pki/root_ca.crt
+ENROL_STEP_PROVISIONER=enrol
+ENROL_STEP_PASSWORD_FILE=/pki/password
+# Issued-cert lifetime. NOTE: the step-ca provisioner must ALLOW this — a stock
+# step-ca caps certs at 24h, so 720h is rejected ("requested duration ... more
+# than the authorized maximum certificate duration of 24h"). The bench
+# step-ca/bootstrap.sh now raises authority.claims.maxTLSCertDuration; a
+# different CA needs the same. Verified end-to-end against a real step-ca.
+ENROL_CERT_NOT_AFTER=720h
+# admin mTLS (only when ENROL_ADMIN_INSECURE=false):
+ENROL_ADMIN_CERT=/pki/broker/server.crt
+ENROL_ADMIN_KEY=/pki/broker/server.key
+ENROL_ADMIN_CLIENT_CA=/pki/broker/admin-ca.crt
+
 # --- SPDK version loader / reaper (declarative rolling updates) -------------
 # The spdk-loader service stages + adds ${IMAGE_VERSION} to the long-lived target
 # on `compose up`, then auto-removes OLD versions once they drain. Migration =