bootstrap: connect to step-ca via localhost, not ca.fleet.lab

The `step` CLI ran against --ca-url https://ca.fleet.lab:8443, but that name is
only served by the fleet dnsmasq to booting clients — the serving host's own
resolver can't resolve it ("no such host on 127.0.0.53"), so provisioner list +
RADIUS cert issuance failed. Connect over CA_CONNECT (default localhost, which
the compose puts in the CA cert SAN); CA_DNS stays the cert/SAN + RADIUS CN name.

serving/dot1x-bench/step-ca/bootstrap.sh

@@ -17,7 +17,14 @@ cd "$(dirname "$0")/.."
 [ -f .env ] && . ./.env
 CA_DNS=${CA_DNS:-ca.fleet.lab}
 CA_PORT=${CA_PORT:-8443}
-CA_URL="https://${CA_DNS}:${CA_PORT}"
+# The CLI must reach the CA over a name that RESOLVES on the serving host AND is
+# in the CA cert's SAN. ca.fleet.lab is only served by the fleet dnsmasq to
+# booting clients — the serving host itself can't resolve it — so default to
+# 'localhost' (the compose adds it to DOCKER_STEPCA_INIT_DNS_NAMES). CA_DNS stays
+# the cert/SAN name (and the RADIUS cert CN). Override CA_CONNECT if the CA is
+# remote/reachable by another resolvable SAN.
+CA_CONNECT=${CA_CONNECT:-localhost}
+CA_URL="https://${CA_CONNECT}:${CA_PORT}"
 PKI=pki
 
 # step-ca initialises its state into ./pki/stepca as uid 1000, but Docker created