feat(tunnel): zero-touch tunnel enrollment — control-plane PKI, host agent, iOS, nginx isolation

Customers install one command / log in once; hardware-generated keys never leave the
device; CSRs return certs + subdomain; frpc + base-app run as durable services. No .p12,
no manual cert import. Implements the MVP fast-path of docs/PLAN_TUNNEL_AUTOMATION.md.

Control-plane / PKI (control-plane/):
- ca/x509-assembler.ts: single KMS-signed real X.509 issuance primitive (Ed25519 + P-256)
- ca/csr-ec.ts: P-256 PKCS#10 proof-of-possession (verifyCsrPoPEc) + CSR-key routing
- ca/frpclient-issue.ts, ca/device-issue.ts: P-256 frp-client + device leaf signers
- ca/rotate.ts + api/renew.ts: real-X.509 /renew + /device/:id/renew (mTLS current cert)
- registry/devices.ts: device registry + per-account cap/rate-limit
- auth/session.ts: device:enroll capability token mint/verify
- api/device-enroll.ts: POST /device/enroll (ownership-gated, deny-by-default)
- pairing/native-redeem.ts + shared gateAndConsumePairingCode; api/provision.ts native arm
- boot/native-ca.ts + main.ts: wire two P-256 CAs + issuers + routers (dev / KMS fail-fast)

Contracts: relay-contracts enroll right; relay-auth SPIFFE /device/ arm + spiffeIdFor(kind)

Host agent (agent/):
- transport/frpcToml.ts; provision/frpcBinary.ts + untar.ts (verify-download + traversal-safe extract)
- keys P-256 keygen/CSR/loadIdentity; service two-unit install + BIND_HOST loopback S-GATE
- net/loopbackLiteral.ts strict guard; health/probe.ts + transport/frpSupervise.ts; cli pair --install

iOS (ios/Packages/ClientTLS): SecureEnclaveKey + CertificateSigningRequest + DeviceEnrollmentClient
+ Keychain enroll refactor (SecKey/Security.framework end-to-end, avoids the -25300 trap)

Isolation (deploy/nginx): njs/getCertSub.js SAN parser + zone-anchored map -> 403

Verified: 758 tests green (control-plane 246, agent 267, relay-auth 133, relay-contracts 85,
iOS ClientTLS 27), all tsc clean; real nginx+njs docker 403/200/400; Swift CSR accepted by
the real control-plane verifier; frpc extract byte-identical to `tar -xO`. Cross-validation
caught + fixed 5 real defects (1 critical, 4 high). Remaining = infra (KMS, nginx deploy,
VPS frps, physical iPhone) per PROGRESS_LOG runbook.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

control-plane/src/boot/ca-wiring.ts

@@ -5,8 +5,14 @@
  * the key ref is unresolvable OR its policy does not restrict `sign` to the control-plane
  * service principal. Both T8 `signHostLeaf` and T15 `renewHostLeaf` call this shared primitive —
  * neither loads a raw key.
+ *
+ * Two in-process dev/test signers implement the SAME `CaSigner` surface (never a KMS — production
+ * mandates a real non-exportable key): `inProcessCaSigner` (Ed25519, the relay agent-CA path) and
+ * `inProcessP256CaSigner` (ECDSA-with-SHA256, the native-tunnel `frp-client-CA` / `device-CA` P-256
+ * path). The P-256 signer returns a raw P1363 `r||s` signature — the shape hardware emits — which
+ * `x509-assembler` normalizes to DER; both expose the same `sign()` so callers stay KMS-shaped.
  */
-import { createPublicKey } from 'node:crypto'
+import { createPublicKey, generateKeyPairSync, sign as nodeSign } from 'node:crypto'
 import type { ControlPlaneEnv } from '../env.js'
 import { ed25519Sign, generateEd25519, type KeyObject } from '../util/crypto.js'
 
@@ -73,3 +79,22 @@ function derivePublicRaw(privateKey: KeyObject): Uint8Array {
   const spki = createPublicKey(privateKey).export({ format: 'der', type: 'spki' }) as Buffer
   return new Uint8Array(spki.subarray(spki.length - 32))
 }
+
+/**
+ * In-process P-256 (ECDSA-with-SHA256) CA signer — TEST/DEV ONLY, same disclaimer as the Ed25519
+ * variant. This is the dev stand-in for the native-tunnel `frp-client-CA` / `device-CA` (both P-256).
+ * `sign()` returns a RAW P1363 `r||s` (64-byte) signature over the TBS — the same shape hardware
+ * (Secure Enclave / StrongBox / WebCrypto) emits — which `x509-assembler` normalizes to DER.
+ * `publicKeyRaw` carries the CA's SubjectPublicKeyInfo DER (not a bare point) so tests can import it
+ * directly as a verifying key.
+ */
+export function inProcessP256CaSigner(privateKey?: KeyObject): CaSigner {
+  const key = privateKey ?? generateKeyPairSync('ec', { namedCurve: 'P-256' }).privateKey
+  const spkiDer = createPublicKey(key).export({ format: 'der', type: 'spki' }) as Buffer
+  return {
+    publicKeyRaw: new Uint8Array(spkiDer),
+    async sign(tbsCert) {
+      return new Uint8Array(nodeSign('sha256', Buffer.from(tbsCert), { key, dsaEncoding: 'ieee-p1363' }))
+    },
+  }
+}