fix(tunnel): close the three leftovers from the renewal-deadlock fix

1. `.gitignore` swallowed a source file. `agent/src/dist/buildBinary.ts` is the
   packaging config, not build output, but the blanket `dist/` rule meant it was
   never committed — a fresh clone could neither typecheck `agent/src/index.ts`
   nor import it from the committed `agent/test/buildBinary.test.ts`. Re-included
   the DIRECTORY first (git does not descend into an excluded one, so un-ignoring
   just the file would not have worked) and committed the file. Verified build
   output under `agent/dist/`, `dist/`, `public/build/` is still ignored.

2. Tunnel logs named no host. `pair` learned hostId/subdomain from the enroll
   response and threw them away, so the long-running `run` process logged
   `{"subdomain":null,"hostId":null}` — including all 6380 warnings during the
   8-day outage, at exactly the moment you want to know which host. New
   `config/hostRecord.ts` persists them at enrol; `resolveHostIdentity` resolves
   config > record > the subdomain embedded in the leaf's SPIFFE SAN, so hosts
   enrolled before the record existed get an identifier back without re-pairing.

3. The phone track had no recovery path. Added `POST /device/:id/recover`,
   mirroring the host route: cert in the body, device-CA path validation, SPIFFE
   parse, `notBefore` never graced, and the full registry check (active + same
   account + `:id` matches the cert + same key) — only `notAfter` is relaxed.

Verified: agent 300/300, control-plane 296/296, tsc clean on both.
NOTE: the iOS/Android clients are not wired to call /device/:id/recover yet —
the server capability exists, the client-side trigger does not.

control-plane/src/api/renew.ts

@@ -433,6 +433,54 @@ export function buildRenewRouter(deps: RenewDeps): FastifyPluginAsync {
       }
     })
 
+    /**
+     * Device counterpart of `/recover` (phone track). Same reason it exists, same shape: the lapsed
+     * cert arrives in the BODY because no terminator forwards an expired client certificate, so this
+     * route is the sole verifier — device-CA path validation, SPIFFE parse, `notBefore`, and the full
+     * registry consistency check (active + same account + `:id` matches the cert + same key). Only
+     * the `notAfter` bound is relaxed, by `expiredRenewGraceMs`.
+     */
+    app.post('/device/:id/recover', async (req, reply) => {
+      try {
+        const body = RecoverBodySchema.parse(req.body)
+        const der = certWireToDer(body.cert)
+        if (der === null) throw new RenewRejectError(401)
+        const identity = parsePresentedCertIdentity(
+          der,
+          'device',
+          deps.deviceCaAnchorsDer
+            ? {
+                caAnchorsDer: deps.deviceCaAnchorsDer,
+                nowMs: Date.now(),
+                expiredGraceMs: recoverGraceMs,
+              }
+            : undefined,
+        )
+        const id = (req.params as { id: string }).id
+        rateLimiter.check(`device-recover:${identity.id}`)
+
+        const record = await deps.devices.getDevice(id)
+        if (
+          record === null ||
+          record.status === 'revoked' ||
+          record.accountId !== identity.accountId ||
+          identity.id !== id ||
+          !timingSafeEqualBytes(record.ecPubkeySpki, identity.publicKeySpki)
+        ) {
+          throw new RenewRejectError(403)
+        }
+
+        const leaf = await deps.renewer.renewDeviceLeaf(id, decodeCsrWire(body.csr))
+        await reply.code(201).send({
+          cert: bytesToBase64(leaf.cert),
+          caChain: leaf.caChain.map((c) => bytesToBase64(c)),
+          notAfter: leaf.notAfter.toISOString(),
+        })
+      } catch (err) {
+        sendError(reply, err)
+      }
+    })
+
     app.post('/device/:id/renew', async (req, reply) => {
       try {
         const der = presentedCert.presentedCertDer(req)