Adding dot1x support

CLAUDE.md

@@ -39,6 +39,8 @@ serving/                                  Lab serving stack: dnsmasq + nginx + S
                                           CI-built + pulled; see .gitea/workflows/)
 serving/kiosk-app/                         Svelte+Tailwind spaceship-terminal SPA
                                           (kiosk endpoint; nginx reverse-proxies /kiosk/)
+serving/dot1x-bench/                      Secure-path bench: step-ca + FreeRADIUS +
+                                          hostapd authenticator + TPM enrolment
 .gitea/workflows/                         Gitea CI: lint -> packer build -> push OCI
 docs/                                     Design PDF and supporting notes
 ```
@@ -308,6 +310,11 @@ authenticator + FreeRADIUS on a veth/bridge (bridge needs
 `group_fwd_mask=8` or EAPOL is silently dropped). Pass criteria: port
 `Authorized`, macsec0 addressed, NVMe namespace connected, verity root
 mapped, overlay writable, supplicant alive after switch-root.
+This harness is scaffolded in **`serving/dot1x-bench/`** (step-ca as the fleet
+CA on the serving host + FreeRADIUS EAP-TLS + a `hostapd` wired authenticator +
+`tpm-provision.sh`), with an **isolated bridge per workstation** (the flat VLAN
+can't authenticate — EAPOL is dropped and MACsec is point-to-point). See its
+README; several configs there are still BENCH-VERIFY.
 
 Any change to the dracut module, supplicant config, or cmdline must pass
 this before merge. Template-only changes need `packer validate` +