enrol-broker: run in serving stack + fix step signer path end-to-end

Verifying the step signer against a real step-ca surfaced two real bugs the
mock signer had hidden, plus made the bench CA actually initialise:

- signer.go: move --not-after from `step ca token` (validity caps ~1h ->
  "token validity too long") to `step ca sign` (it is the CERT lifetime).
  Without this the step signer never issues a cert.
- dot1x-bench compose: DOCKER_STEPCA_INIT_PASSWORD_FILE pointed at a file that
  does not exist at first init (it is an INPUT path), so `step ca init` failed
  and never wrote secrets/password. Use DOCKER_STEPCA_INIT_PASSWORD (the value)
  which the entrypoint writes to secrets/password, where bootstrap + broker read.
- bootstrap.sh: self-heal the root-owned ./pki Docker auto-creates; detect the
  CA password at $STEPPATH/password or secrets/password (varies by image
  version); raise authority.claims.maxTLSCertDuration so 720h fleet certs are
  allowed (stock cap 24h, which also blocked bootstrap's own RADIUS cert); fix
  RADIUS cert paths to write via the /export mount (were host paths run inside
  the container, so they never resolved).

- serving stack: add the enrol-broker service (temporary home; nginx already
  proxies /enrol/) defaulting to the zero-dependency lab path (mock signer +
  insecure loopback admin), with ENROL_* knobs to switch to step + mTLS.
- verify-serving.sh: exercise request -> approve -> cert through the deployed
  nginx /enrol/ proxy.
- TODO #11: record the step-signer verification + the two fixes.

Step signer VERIFIED end-to-end against a real step-ca: issued cert chains to
the fleet root, EKU clientAuth, hostnqn derived from serial.

serving/dot1x-bench/docker-compose.yml

@@ -25,7 +25,13 @@ services:
       DOCKER_STEPCA_INIT_DNS_NAMES: "${CA_DNS:-ca.fleet.lab},localhost"
       DOCKER_STEPCA_INIT_ADDRESS: ":${CA_PORT:-8443}"
       DOCKER_STEPCA_INIT_PROVISIONER_NAME: "enrol"
-      DOCKER_STEPCA_INIT_PASSWORD_FILE: "/home/step/secrets/password"
+      # Password to encrypt the CA keys + 'enrol' provisioner. Must be the VALUE
+      # (_PASSWORD), not _PASSWORD_FILE: the latter is an INPUT path the entrypoint
+      # reads FROM (for a mounted docker secret), which doesn't exist at first
+      # init → `step ca init` fails → no CA, no secrets/password (the "CA not
+      # initialised" error). With _PASSWORD the entrypoint WRITES it to
+      # /home/step/secrets/password, where bootstrap.sh + the enrol-broker read it.
+      DOCKER_STEPCA_INIT_PASSWORD: "${CA_PASSWORD:-changeme-bench}"
     volumes:
       - ./pki/stepca:/home/step          # CA state (root/intermediate/keys/db) — gitignored
       - ./pki:/export                     # bootstrap.sh drops root_ca.crt here for the image/radius