feat(ios): device enrollment flow + silent cert rotation (B3)

Wire the SecureEnclave enroll library into a real flow (login->bearer->CSR->
/device/enroll->keychain identity), presented on the existing mTLS path; add a
rotation scheduler. Atomic keychain replace (add-before-delete); renew body is
{csr}-only; renewal-failing surfaced in the UI. ClientTLS 48 tests pass.

ios/App/WebTerm/Wiring/SplitRootView.swift

@@ -40,7 +40,8 @@ struct SplitRootView: View {
                 coordinator.selectSidebarItem(sidebarItem(for: request))
             },
             onAddHost: { coordinator.presentAddHost() },
-            onDeviceCert: { coordinator.presentDeviceCert() }
+            onDeviceCert: { coordinator.presentDeviceCert() },
+            onEnroll: { coordinator.presentEnrollment() }
         )
         .safeAreaInset(edge: .bottom) { continueLastBanner }
         .animation(