feat(control-plane): real X.509 agent leaf issuance (closes enrollment↔mTLS gap)

- ca/issue.ts: real X.509 v3 Ed25519 leaf with SPIFFE URI SAN, signed by the
  intermediate; SAN built via relay-auth spiffeIdFor so it can't drift
- ca/csr.ts: parse real PKCS#10 (agent's PEM) + async PoP verify; decodeCsrWire
  accepts PEM or base64(DER)
- main.ts/env.ts: real issuer when CA_INTERMEDIATE_KEY_PATH present, else dev fallback
- interop.test.ts: oracle proving relay-auth verifyAgentCert accepts the leaf (6 tests)
- deps: @peculiar/x509, reflect-metadata

control-plane/package.json

@@ -16,11 +16,13 @@
     "coverage": "vitest run --coverage"
   },
   "dependencies": {
-    "relay-contracts": "file:../relay-contracts",
-    "relay-auth": "file:../relay-auth",
+    "@peculiar/x509": "^2.0.0",
     "fastify": "^4.28.1",
     "ioredis": "^5.4.1",
     "pg": "^8.12.0",
+    "reflect-metadata": "^0.2.2",
+    "relay-auth": "file:../relay-auth",
+    "relay-contracts": "file:../relay-contracts",
     "zod": "^3.23.8"
   },
   "devDependencies": {