Merge remote-tracking branch 'origin/main' into secure-ntp

docs/tpm-enrolment-design.md

@@ -348,8 +348,9 @@ exists. Enrolment is where it comes into being.
    `tpm-selftest.sh` capability check; step-ca + EAP-TLS bench.
 2. **Broker — BUILT (2026-06-28): [`serving/enrol-broker/`](../serving/enrol-broker/).**
    Go, stdlib-only. Public unauth listener (`POST /request`, `GET /status/{id}`)
-   behind the serving nginx `/enrol/`; admin **mTLS web UI** (`/`, `/pending`,
-   `/approve|deny/{id}`) on the mgmt network; wordlist fingerprint = `H(CSR-pubkey ‖
+   behind the serving nginx `/enrol/`; admin **mTLS JSON API** (`/pending`,
+   `/approve|deny/{id}`) on the mgmt network — driven by the fleet-manager passkey
+   SPA (the broker's own HTML console was retired 2026-07-11); wordlist fingerprint = `H(CSR-pubkey ‖
    server-nonce)`; time-boxed in-memory store + per-IP rate limit; signs via
    `step ca token`+`step ca sign` (broker holds the provisioner password) with a
    dev `mock` signer. **Fingerprint-only assurance.** Admin client CA is a