feat(cloud): add edge host enrollment

apps/device-host-agent/tests/test_config.py

@@ -1,5 +1,7 @@
 from __future__ import annotations
 
+from pathlib import Path
+
 import pytest
 
 from host_agent.config import (
@@ -40,11 +42,44 @@ def test_load_host_agent_config_parses_poll_and_retry_values() -> None:
     assert config.max_retry_backoff_seconds == 20
 
 
+def test_load_host_agent_config_supports_managed_enrollment(tmp_path) -> None:
+    identity_path = tmp_path / "host_identity.json"
+    config = load_host_agent_config(
+        {
+            "HOST_AGENT_CONTROL_PLANE_URL": "https://cloud.example",
+            "HOST_AGENT_ENROLLMENT_TOKEN": "one-time-token",
+            "HOST_AGENT_IDENTITY_PATH": str(identity_path),
+            "HOST_AGENT_DISPLAY_NAME": "Edge Mac",
+        }
+    )
+
+    assert config.host_id == ""
+    assert config.token == ""
+    assert config.enrollment_token == "one-time-token"
+    assert config.identity_path == identity_path
+    assert config.enrollment_managed is True
+    assert config.display_name == "Edge Mac"
+    assert "one-time-token" not in repr(config)
+
+
+def test_existing_identity_state_allows_restart_without_enrollment_token(
+    tmp_path,
+) -> None:
+    identity_path = tmp_path / "host_identity.json"
+    identity_path.write_text("{}", encoding="utf-8")
+
+    config = load_host_agent_config({"HOST_AGENT_IDENTITY_PATH": str(identity_path)})
+
+    assert config.identity_path == Path(identity_path)
+    assert config.enrollment_managed is True
+
+
 @pytest.mark.parametrize(
     "overrides",
     [
         {"HOST_AGENT_HOST_ID": ""},
         {"HOST_AGENT_TOKEN": ""},
+        {"HOST_AGENT_HOST_ID": "host-a", "HOST_AGENT_TOKEN": ""},
         {"HOST_AGENT_CONTROL_PLANE_URL": "ftp://cloud.example"},
         {"HOST_AGENT_POLL_TIMEOUT_SECONDS": "0"},
         {