fix(tunnel): close the three leftovers from the renewal-deadlock fix

1. `.gitignore` swallowed a source file. `agent/src/dist/buildBinary.ts` is the
   packaging config, not build output, but the blanket `dist/` rule meant it was
   never committed — a fresh clone could neither typecheck `agent/src/index.ts`
   nor import it from the committed `agent/test/buildBinary.test.ts`. Re-included
   the DIRECTORY first (git does not descend into an excluded one, so un-ignoring
   just the file would not have worked) and committed the file. Verified build
   output under `agent/dist/`, `dist/`, `public/build/` is still ignored.

2. Tunnel logs named no host. `pair` learned hostId/subdomain from the enroll
   response and threw them away, so the long-running `run` process logged
   `{"subdomain":null,"hostId":null}` — including all 6380 warnings during the
   8-day outage, at exactly the moment you want to know which host. New
   `config/hostRecord.ts` persists them at enrol; `resolveHostIdentity` resolves
   config > record > the subdomain embedded in the leaf's SPIFFE SAN, so hosts
   enrolled before the record existed get an identifier back without re-pairing.

3. The phone track had no recovery path. Added `POST /device/:id/recover`,
   mirroring the host route: cert in the body, device-CA path validation, SPIFFE
   parse, `notBefore` never graced, and the full registry check (active + same
   account + `:id` matches the cert + same key) — only `notAfter` is relaxed.

Verified: agent 300/300, control-plane 296/296, tsc clean on both.
NOTE: the iOS/Android clients are not wired to call /device/:id/recover yet —
the server capability exists, the client-side trigger does not.

deploy/nginx/enroll-recover-location.md

@@ -45,7 +45,10 @@ and it is still proven end to end:
 Worst case for a replayed cert without the key: the attacker receives a certificate they cannot
 authenticate with. Revocation still bites, via registry status.
 
-## The block to add
+## The blocks to add
+
+Two routes, same rationale: `/recover` re-issues an expired **host** frp-client leaf,
+`/device/:id/recover` does the same for an expired **device** cert (phone track).
 
 ```nginx
     # Expired-leaf recovery: NO client cert (see enroll-recover-location.md). The control-plane is
@@ -58,6 +61,17 @@ authenticate with. Revocation still bites, via registry status.
         proxy_set_header x-client-cert "";
         proxy_read_timeout 60s;
     }
+    # Same, for an expired DEVICE cert. Must sit ABOVE the `~ ^/device/[^/]+/renew$` mTLS location
+    # only if that regex could also match `/recover` — it cannot, but keep them adjacent so the pair
+    # is obvious to the next editor.
+    location ~ ^/device/[^/]+/recover$ {
+        limit_req zone=renew_recover burst=5 nodelay;
+        proxy_pass http://127.0.0.1:8080;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header x-client-cert "";
+        proxy_read_timeout 60s;
+    }
 ```
 
 And once, in the `http` context (top of `enroll.conf` is fine) — the route is reachable