feat(tunnel): zero-touch tunnel enrollment — control-plane PKI, host agent, iOS, nginx isolation

Customers install one command / log in once; hardware-generated keys never leave the
device; CSRs return certs + subdomain; frpc + base-app run as durable services. No .p12,
no manual cert import. Implements the MVP fast-path of docs/PLAN_TUNNEL_AUTOMATION.md.

Control-plane / PKI (control-plane/):
- ca/x509-assembler.ts: single KMS-signed real X.509 issuance primitive (Ed25519 + P-256)
- ca/csr-ec.ts: P-256 PKCS#10 proof-of-possession (verifyCsrPoPEc) + CSR-key routing
- ca/frpclient-issue.ts, ca/device-issue.ts: P-256 frp-client + device leaf signers
- ca/rotate.ts + api/renew.ts: real-X.509 /renew + /device/:id/renew (mTLS current cert)
- registry/devices.ts: device registry + per-account cap/rate-limit
- auth/session.ts: device:enroll capability token mint/verify
- api/device-enroll.ts: POST /device/enroll (ownership-gated, deny-by-default)
- pairing/native-redeem.ts + shared gateAndConsumePairingCode; api/provision.ts native arm
- boot/native-ca.ts + main.ts: wire two P-256 CAs + issuers + routers (dev / KMS fail-fast)

Contracts: relay-contracts enroll right; relay-auth SPIFFE /device/ arm + spiffeIdFor(kind)

Host agent (agent/):
- transport/frpcToml.ts; provision/frpcBinary.ts + untar.ts (verify-download + traversal-safe extract)
- keys P-256 keygen/CSR/loadIdentity; service two-unit install + BIND_HOST loopback S-GATE
- net/loopbackLiteral.ts strict guard; health/probe.ts + transport/frpSupervise.ts; cli pair --install

iOS (ios/Packages/ClientTLS): SecureEnclaveKey + CertificateSigningRequest + DeviceEnrollmentClient
+ Keychain enroll refactor (SecKey/Security.framework end-to-end, avoids the -25300 trap)

Isolation (deploy/nginx): njs/getCertSub.js SAN parser + zone-anchored map -> 403

Verified: 758 tests green (control-plane 246, agent 267, relay-auth 133, relay-contracts 85,
iOS ClientTLS 27), all tsc clean; real nginx+njs docker 403/200/400; Swift CSR accepted by
the real control-plane verifier; frpc extract byte-identical to `tar -xO`. Cross-validation
caught + fixed 5 real defects (1 critical, 4 high). Remaining = infra (KMS, nginx deploy,
VPS frps, physical iPhone) per PROGRESS_LOG runbook.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

deploy/nginx/frp-mtls.conf

@@ -10,6 +10,32 @@
 #
 # nginx 1.24: there is NO standalone `http2` directive here and NO `http2 off;` — HTTP/2 is off by
 # default on this listen and `http2 off;` is INVALID on 1.24 (would fail `nginx -t`, PLAN R7).
+#
+# A3 / FIX C-native-3 — cert→Host BINDING (the SINGLE load-bearing tenant-isolation control). On top
+# of `ssl_verify_client on` (which only proves the cert is device-CA-signed), njs parses the leaf's
+# dNSName SAN and a `map` requires its leftmost label == the leftmost label of the requested SNI,
+# `return 403` otherwise. A cert stamped `alice.terminal.yaojia.wang` may ONLY reach `alice.*`; a
+# tenant-A cert presented to tenant-B's host is denied. Rule lives in the `map` (never scattered
+# `if`s); exactly one `if` guards the single `return 403`.
+#
+# PREREQ (VPS main nginx.conf, MAIN context — NOT here): `load_module modules/ngx_http_js_module.so;`
+# (Debian nginx: `apt-get install nginx-module-njs`). Install the module file to /etc/nginx/njs/
+# getCertSub.js so the relative `js_import` below resolves against the /etc/nginx prefix.
+
+js_import certsub from njs/getCertSub.js;
+js_set    $cert_sub certsub.getCertSub;   # leftmost dNSName SAN label of the verified client cert ('' on any parse failure)
+
+# Allow iff the requested SNI is EXACTLY `<cert_sub>.terminal.yaojia.wang` — the cert's leftmost
+# dNSName label equals the requested subdomain, anchored to the FULL zone. Anchoring the zone here
+# (not just `<label>.`) makes this map SELF-SUFFICIENT: it does not depend on the `server_name` regex
+# (line ~46) or the stream SNI routing to constrain the zone — belt-and-suspenders for the one control.
+# `(?P=s)` is the PCRE named backreference to `s`. An empty $cert_sub (fail-closed njs output) can
+# never satisfy `[^:]+`, so it always falls through to `default 0` → denied. Case-sensitive (~):
+# our subdomains and stamped SANs are lowercase.
+map "$cert_sub:$ssl_server_name" $cert_host_ok {
+    "~^(?<s>[^:]+):(?P=s)\.terminal\.yaojia\.wang$"  1;
+    default                                          0;
+}
 
 map $http_upgrade $connection_upgrade {
     default upgrade;
@@ -29,6 +55,11 @@ server {
     ssl_verify_depth 1;
     ssl_crl /etc/relay/device-ca/crl.pem;                   # revocation from day one (V2)
 
+    # --- A3 cert→Host binding gate (runs AFTER ssl_verify_client) ---
+    # The one `if` guarding the single `return`; the actual rule is in the $cert_host_ok map above.
+    # Denies before ANY location is reached (protects /, /hook*, /live-sessions/:id/preview, …).
+    if ($cert_host_ok = 0) { return 403; }
+
     location / {
         proxy_pass http://127.0.0.1:7080;                   # frps vhost — routes by Host → subdomain
         proxy_http_version 1.1;