enrol-broker: run in serving stack + fix step signer path end-to-end

Verifying the step signer against a real step-ca surfaced two real bugs the
mock signer had hidden, plus made the bench CA actually initialise:

- signer.go: move --not-after from `step ca token` (validity caps ~1h ->
  "token validity too long") to `step ca sign` (it is the CERT lifetime).
  Without this the step signer never issues a cert.
- dot1x-bench compose: DOCKER_STEPCA_INIT_PASSWORD_FILE pointed at a file that
  does not exist at first init (it is an INPUT path), so `step ca init` failed
  and never wrote secrets/password. Use DOCKER_STEPCA_INIT_PASSWORD (the value)
  which the entrypoint writes to secrets/password, where bootstrap + broker read.
- bootstrap.sh: self-heal the root-owned ./pki Docker auto-creates; detect the
  CA password at $STEPPATH/password or secrets/password (varies by image
  version); raise authority.claims.maxTLSCertDuration so 720h fleet certs are
  allowed (stock cap 24h, which also blocked bootstrap's own RADIUS cert); fix
  RADIUS cert paths to write via the /export mount (were host paths run inside
  the container, so they never resolved).

- serving stack: add the enrol-broker service (temporary home; nginx already
  proxies /enrol/) defaulting to the zero-dependency lab path (mock signer +
  insecure loopback admin), with ENROL_* knobs to switch to step + mTLS.
- verify-serving.sh: exercise request -> approve -> cert through the deployed
  nginx /enrol/ proxy.
- TODO #11: record the step-signer verification + the two fixes.

Step signer VERIFIED end-to-end against a real step-ca: issued cert chains to
the fleet root, EKU clientAuth, hostnqn derived from serial.

serving/docker-compose.yml

@@ -189,6 +189,51 @@ services:
     # For HTTPS boot (production), terminate TLS here with the boot-infra CA's
     # cert and switch the dhcp-boot URL above to https://. Left HTTP for the lab.
 
+  # --- TPM enrolment broker (TEMPORARY home — see docs/TODO.md #11) -----------
+  # The `http` nginx already reverse-proxies /enrol/ -> 127.0.0.1:9090 (this
+  # broker's public listener), so an empty-NV host can POST its CSR and poll for
+  # the signed cert via the normal serving host. For now the broker runs HERE so
+  # a single `compose up` in serving/ brings the enrolment endpoint up.
+  #
+  # ⚠ PROPER HOME is its own stack co-located with step-ca (the fleet CA), i.e.
+  # serving/dot1x-bench/, since REAL signing needs that CA. SPLIT THIS BACK OUT
+  # once the CA lives beside it. Do NOT run this AND dot1x-bench's enrol-broker on
+  # the same host — they collide on 9090/9443.
+  #
+  # Defaults below are the zero-dependency LAB path: `mock` signer (ephemeral
+  # in-process CA — certs are NOT trusted by RADIUS/NVMe) + plaintext loopback
+  # admin. For REAL enrolment, in .env set ENROL_SIGNER=step + point
+  # ENROL_STEP_CA_* at a reachable step-ca, and set ENROL_ADMIN_INSECURE=false
+  # after generating the admin mTLS PKI (a DEDICATED admin CA, not the fleet root):
+  #   ./enrol-broker/admin-pki.sh ./enrol-pki/broker <admin-name>
+  # then import enrol-pki/broker/clients/<admin>.p12 and open https://127.0.0.1:9443/
+  enrol-broker:
+    build: ./enrol-broker
+    network_mode: host          # public on 127.0.0.1:9090 (nginx proxies /enrol/)
+    restart: unless-stopped
+    environment:
+      BROKER_PUBLIC_ADDR: "127.0.0.1:9090"   # nginx /enrol/ proxies here
+      BROKER_ADMIN_ADDR: "127.0.0.1:9443"    # mgmt/loopback ONLY — never the boot LAN
+      BROKER_SIGNER: ${ENROL_SIGNER:-mock}
+      BROKER_PENDING_TTL: ${ENROL_PENDING_TTL:-10m}
+      BROKER_WORDS: ${ENROL_WORDS:-8}
+      HOSTNQN_BASE: ${ENROL_HOSTNQN_BASE:-nqn.2026-06.org.example.fleet:host-}
+      # --- step signer (only consulted when ENROL_SIGNER=step) ---
+      STEP_CA_URL: ${ENROL_STEP_CA_URL:-}
+      STEP_CA_ROOT: ${ENROL_STEP_CA_ROOT:-/pki/root_ca.crt}
+      STEP_PROVISIONER: ${ENROL_STEP_PROVISIONER:-enrol}
+      STEP_PROVISIONER_PASSWORD_FILE: ${ENROL_STEP_PASSWORD_FILE:-/pki/password}
+      STEP_CERT_NOT_AFTER: ${ENROL_CERT_NOT_AFTER:-720h}
+      # --- admin mTLS (set ENROL_ADMIN_INSECURE=false for real mTLS) ---
+      BROKER_ADMIN_INSECURE: ${ENROL_ADMIN_INSECURE:-true}
+      BROKER_ADMIN_CERT: ${ENROL_ADMIN_CERT:-/pki/broker/server.crt}
+      BROKER_ADMIN_KEY: ${ENROL_ADMIN_KEY:-/pki/broker/server.key}
+      BROKER_ADMIN_CLIENT_CA: ${ENROL_ADMIN_CLIENT_CA:-/pki/broker/admin-ca.crt}
+    volumes:
+      # CA root + provisioner password (step signer) and admin mTLS certs live
+      # here; unused/empty for the default mock+insecure path. Gitignored.
+      - ./enrol-pki:/pki:ro
+
   # --- Kiosk SPA (spaceship terminal shown by the diskless kiosk) ------------
   # Svelte + Tailwind app built into a static bundle served by its own nginx.
   # Now an INDEPENDENT project — the `kiosk-app` git submodule (its own repo +