feat(tunnel): zero-touch tunnel enrollment — control-plane PKI, host agent, iOS, nginx isolation

Customers install one command / log in once; hardware-generated keys never leave the
device; CSRs return certs + subdomain; frpc + base-app run as durable services. No .p12,
no manual cert import. Implements the MVP fast-path of docs/PLAN_TUNNEL_AUTOMATION.md.

Control-plane / PKI (control-plane/):
- ca/x509-assembler.ts: single KMS-signed real X.509 issuance primitive (Ed25519 + P-256)
- ca/csr-ec.ts: P-256 PKCS#10 proof-of-possession (verifyCsrPoPEc) + CSR-key routing
- ca/frpclient-issue.ts, ca/device-issue.ts: P-256 frp-client + device leaf signers
- ca/rotate.ts + api/renew.ts: real-X.509 /renew + /device/:id/renew (mTLS current cert)
- registry/devices.ts: device registry + per-account cap/rate-limit
- auth/session.ts: device:enroll capability token mint/verify
- api/device-enroll.ts: POST /device/enroll (ownership-gated, deny-by-default)
- pairing/native-redeem.ts + shared gateAndConsumePairingCode; api/provision.ts native arm
- boot/native-ca.ts + main.ts: wire two P-256 CAs + issuers + routers (dev / KMS fail-fast)

Contracts: relay-contracts enroll right; relay-auth SPIFFE /device/ arm + spiffeIdFor(kind)

Host agent (agent/):
- transport/frpcToml.ts; provision/frpcBinary.ts + untar.ts (verify-download + traversal-safe extract)
- keys P-256 keygen/CSR/loadIdentity; service two-unit install + BIND_HOST loopback S-GATE
- net/loopbackLiteral.ts strict guard; health/probe.ts + transport/frpSupervise.ts; cli pair --install

iOS (ios/Packages/ClientTLS): SecureEnclaveKey + CertificateSigningRequest + DeviceEnrollmentClient
+ Keychain enroll refactor (SecKey/Security.framework end-to-end, avoids the -25300 trap)

Isolation (deploy/nginx): njs/getCertSub.js SAN parser + zone-anchored map -> 403

Verified: 758 tests green (control-plane 246, agent 267, relay-auth 133, relay-contracts 85,
iOS ClientTLS 27), all tsc clean; real nginx+njs docker 403/200/400; Swift CSR accepted by
the real control-plane verifier; frpc extract byte-identical to `tar -xO`. Cross-validation
caught + fixed 5 real defects (1 critical, 4 high). Remaining = infra (KMS, nginx deploy,
VPS frps, physical iPhone) per PROGRESS_LOG runbook.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

control-plane/src/store/ports.ts

@@ -21,6 +21,9 @@ import type {
   RouteEntry,
   SessionRecord,
 } from '../model/records.js'
+// A4 add-only (FIX C-native-1): the device data-path identity records own their types in the
+// registry module (model/records.ts is frozen for this task); import them type-only here.
+import type { DeviceRecord, DeviceStatus, DeviceStatusVersionRow } from '../registry/devices.js'
 
 export interface AccountStore {
   insert(rec: AccountRecord): Promise<void>
@@ -52,6 +55,35 @@ export interface SessionStore {
   get(sessionId: string): Promise<SessionRecord | null>
 }
 
+/**
+ * A4 (add-only) — device data-path identity store (FIX C-native-1). Mirrors `HostStore`: versioned
+ * status snapshots (INV8) + an ACTIVE-count read for the per-account device cap. The in-memory
+ * adapter lives in `registry/devices.ts` (`createMemoryDeviceStore`), not `store/memory.ts`, so the
+ * shared `Stores` wiring is untouched.
+ */
+export interface DeviceStore {
+  insert(rec: DeviceRecord): Promise<void>
+  get(deviceId: string): Promise<DeviceRecord | null>
+  listByAccount(accountId: string): Promise<readonly DeviceRecord[]>
+  /** Count of ACTIVE (non-revoked) devices for the per-account cap. */
+  countActiveByAccount(accountId: string): Promise<number>
+  /** Atomic status version + pointer swap. `revokedAt` set only on 'revoked'. Returns NEW record. */
+  swapStatus(
+    deviceId: string,
+    status: DeviceStatus,
+    revokedAt: string | null,
+    changedBy: string,
+  ): Promise<DeviceRecord>
+  /**
+   * Persist a fresh leaf expiry on RENEWAL (mirrors the host `now()+ttl` fresh-expiry pattern).
+   * Atomic single-row pointer update — the record is the CRL/expiry pairing source of truth, so it
+   * must track the emitted cert. NOT status-versioned (INV8 covers status, not expiry). Returns the
+   * NEW record. Throws if `deviceId` is unknown.
+   */
+  renewLeafExpiry(deviceId: string, notAfter: string): Promise<DeviceRecord>
+  versions(deviceId: string): Promise<readonly DeviceStatusVersionRow[]>
+}
+
 /** Reservation of a subdomain label; atomic single-winner under concurrency (INV1). */
 export interface SubdomainStore {
   reserve(subdomain: string): Promise<boolean> // false ⇒ already taken