fleet-manager: checkpoint 3 — authorise pillar (broker fold-in, births inventory)

The AUTHORISE pillar: the manager owns the enrolment queue UX, the enrol-broker
stays the state machine + step-ca signer (v1 'alongside' fold-in).

enrol-broker (minimal, backward-compatible change):
- admin approve/deny now return the decided Enrolment as JSON when the caller
  sends Accept: application/json. Browsers still redirect; other API callers
  (verify-serving.sh) still get 204. The cert PEM stays unexported (only the
  requesting host gets it via /status) — the JSON carries cert_serial, hostnqn,
  context, fingerprint, cn.

fleet-manager:
- broker.go: mTLS client for the broker admin plane (Pending/Approve/Deny),
  nil when unconfigured so the manager runs standalone.
- admin.go: GET /api/enrol/pending (proxy), POST /api/enrol/{id}/approve
  (drives broker, then BIRTHS the inventory record — identity from the returned
  serial/hostnqn/context, binding from the operator's optional body, enrolled
  with the HUMAN approver = the manager's admin mTLS CN), POST .../deny.
  503 when the broker isn't wired.

Test: httptest mock broker asserts the Accept:application/json approve, pending
proxy, inventory birth (identity+binding+enrolled), and the disabled-503 path.
Broker + manager both build/vet/test/gofmt clean.

serving/fleet-manager/README.md

@@ -63,9 +63,17 @@ inspectable, reproducible; a DB swap is a drop-in behind the `Store` interface.
 | `GET /api/hosts` | ✅ ckpt 1 — fleet overview |
 | `GET /api/hosts/{serial}` | ✅ ckpt 1 — host detail |
 | `PUT /api/hosts/{serial}/desired` | ✅ ckpt 1 — set desired-state (audited to admin CN) |
-| `GET /api/enrol/pending`, `POST /api/enrol/{id}/approve\|deny` | ⏳ ckpt 3 (drives the broker) |
+| `GET /api/enrol/pending` | ✅ ckpt 3 — proxies the broker queue |
+| `POST /api/enrol/{id}/approve` | ✅ ckpt 3 — signs via broker + **births inventory** (identity/binding/enrolled) |
+| `POST /api/enrol/{id}/deny` | ✅ ckpt 3 |
 | `GET /api/hosts/{serial}/metrics` | ⏳ ckpt 4 (InfluxDB/Flux) |
 
+The authorise pillar drives the enrol-broker's admin plane over mTLS (the manager
+is a service client, gated by the dedicated admin CA) asking for JSON, so an
+approve returns the decided enrolment; the manager records the **human** approver
+(its own admin mTLS CN) and births the inventory record. The broker stays the
+enrolment state machine + step-ca signer (v1 "alongside" fold-in).
+
 **Agent plane** — gRPC `FleetAgent.Session` bidi over mTLS (fleet CA): ✅ ckpt 2.
 `Hello`/`HealthSnapshot`/`CommandResult` up; `DesiredState`/`Command` down.
 Identity is the peer cert serial (never self-asserted); an unenrolled serial is
@@ -84,6 +92,9 @@ inventory for offline delivery. Metrics writing is behind a `MetricsSink`
 | `FLEET_MGR_AGENT_ADDR` | `127.0.0.1:9600` | gRPC agent listener |
 | `FLEET_MGR_AGENT_CERT` / `_KEY` | — | agent-plane server cert/key |
 | `FLEET_MGR_AGENT_CLIENT_CA` | — | **fleet CA** (verifies host TPM certs). Agent plane starts only when all three are set. |
+| `FLEET_MGR_BROKER_URL` | — | enrol-broker admin base URL (e.g. `https://127.0.0.1:9443`). Authorise pillar enabled only when set. |
+| `FLEET_MGR_BROKER_CLIENT_CERT` / `_KEY` | — | manager's client cert for the broker admin mTLS (admin CA) |
+| `FLEET_MGR_BROKER_CA` | — | CA that signs the broker's admin server cert |
 | `FLEET_MGR_INVENTORY` | `/var/lib/fleet-manager/inventory.json` | inventory file (mount a volume) |
 | `FLEET_MGR_SEED` | `false` | inject demo hosts so the SPA has data — dev only |
 | `HOSTNQN_BASE` | `nqn.2026-06.org.example.fleet:host-` | hostnqn prefix (match the broker) |
@@ -106,5 +117,9 @@ curl -s localhost:9500/api/hosts | jq '.hosts[] | {name:.identity.starship_name,
 - **Checkpoint 2 (done):** gRPC agent plane — proto contract, mTLS (fleet CA)
   server, stream registry, identity-from-cert, snapshot→inventory, live
   desired-state push, `MetricsSink` seam. Full mTLS integration test.
-- Next: authorise/broker fold-in (ckpt 3) → InfluxDB read/write (ckpt 4) → themed
-  SPA (ckpt 5) → Docker/compose + PKI + docs (ckpt 6).
+- **Checkpoint 3 (done):** authorise pillar — the enrol-broker gained an
+  `Accept`-gated JSON approve response (browsers/`verify-serving.sh` unchanged);
+  the manager drives it over mTLS and births the inventory record on approve.
+  httptest-mock-broker test.
+- Next: InfluxDB read/write (ckpt 4) → themed SPA (ckpt 5) → Docker/compose + PKI
+  + docs (ckpt 6).