feat(cloud): add edge host enrollment

tests/test_cloud_control_config.py

@@ -47,6 +47,20 @@ def test_load_control_config_parses_deployment_values() -> None:
     assert "sdk-secret" not in repr(config)
 
 
+def test_load_control_config_parses_enrollment_credentials() -> None:
+    config = load_control_config(
+        {
+            "CLOUD_ENROLLMENT_TOKENS_JSON": (
+                '[{"principal_id":"installer-a","token":"one-time-enrollment-secret"}]'
+            )
+        }
+    )
+
+    assert len(config.enrollment_credentials) == 1
+    assert config.enrollment_credentials[0].principal_id == "installer-a"
+    assert "one-time-enrollment-secret" not in repr(config)
+
+
 @pytest.mark.parametrize(
     "environment,database_url",
     [("invalid", "sqlite:///test.db"), ("local", "mysql://db/cloud")],
@@ -97,13 +111,17 @@ def test_load_control_config_rejects_missing_production_credentials() -> None:
             "CLOUD_HOST_CREDENTIALS_JSON",
             '[{"principal_id":"agent","token":"secret","scopes":[]}]',
         ),
+        (
+            "CLOUD_ENROLLMENT_TOKENS_JSON",
+            '[{"principal_id":"installer","token":123}]',
+        ),
     ],
 )
 def test_load_control_config_rejects_invalid_credentials(
     name: str,
     value: str,
 ) -> None:
-    with pytest.raises(CloudConfigurationError, match="credentials") as error:
+    with pytest.raises(CloudConfigurationError, match="credential") as error:
         load_control_config({name: value})
     assert "secret" not in str(error.value)