Implement edge-host-self-enrollment

Host Agent:
- One-time local operator account bootstrap (PBKDF2-HMAC-SHA256, atomic
  0600-permission write) gating the daemon's first unattended start via a
  new `setup` CLI subcommand.
- Default control-plane URL now https://amcp.home.jerryyan.top (env var
  override unchanged).
- Enrollment no longer requires a pre-issued token; falls back to
  zero-token self-service enrollment when none is configured.

Cloud control plane:
- CLOUD_SELF_SERVICE_ENROLLMENT_ENABLED (default false) opt-in flag.
- SelfServiceEnrollmentAuthProvider + ChainedEnrollmentAuthProvider:
  configured tokens still take priority; self-service only applies when
  no token matches, preserving edge-host-enrollment's token-bound path.
- Fixed a latent bug in sql_repository.py::enroll_host: the token-conflict
  lookup used `== enrollment_token_digest`, which SQLAlchemy compiles to
  `IS NULL` when the value is None, so every self-service enrollment after
  the first would have falsely collided with an existing NULL-digest host.
  Skipped that lookup entirely when the digest is None.

Docs/deploy: .env.example, compose.yaml, compose.deploy.yaml,
CLOUD_DEPLOYMENT.md, MACOS_IPHONE_SETUP.md updated for the new flag,
URL default, and required `device-host-agent setup` step.

Verification: 494 non-integration tests pass; openspec validate --strict
passes. PostgreSQL-backed contract tests and full manual end-to-end
verification were not run (no Postgres/Docker or reachable cloud-api in
this environment); noted as unchecked in tasks.md 7.2/7.4.

.env.example

@@ -11,6 +11,10 @@ CLOUD_API_PORT=8001
 CLOUD_PUBLIC_CREDENTIALS_JSON=[{"principal_id":"local-sdk","token":"change-me-public-token","scopes":["tasks:submit","tasks:read","pool:read","plugins:read","plugins:admin"]}]
 CLOUD_HOST_CREDENTIALS_JSON=[{"principal_id":"local-host-agent","token":"change-me-host-token","scopes":[],"host_id":"host-local"}]
 CLOUD_ENROLLMENT_TOKENS_JSON=[{"principal_id":"edge-installer","token":"change-me-enrollment-token"}]
+# Zero-token self-service Host enrollment (see docs/CLOUD_DEPLOYMENT.md). Only
+# enable this on a deployment whose control-plane URL is not reachable by
+# untrusted networks; any caller that reaches it can register itself as a Host.
+CLOUD_SELF_SERVICE_ENROLLMENT_ENABLED=false
 CLOUD_SCHEDULER_INTERVAL_SECONDS=1
 CLOUD_LEASE_REAPER_INTERVAL_SECONDS=5
 CLOUD_LEASE_DURATION_SECONDS=60
@@ -29,6 +33,10 @@ HOST_AGENT_HOST_ID=host-local
 HOST_AGENT_TOKEN=change-me-host-token
 HOST_AGENT_ENROLLMENT_TOKEN=
 HOST_AGENT_IDENTITY_PATH=/app/tasks/host_identity.json
+# One-time local operator account gate; run `device-host-agent setup`
+# interactively before the daemon's first unattended start (see
+# docs/CLOUD_DEPLOYMENT.md).
+HOST_AGENT_LOCAL_ACCOUNT_PATH=/app/tasks/host_local_account.json
 HOST_AGENT_DISPLAY_NAME=
 HOST_AGENT_TASKS_PATH=./tasks
 HOST_AGENT_HEARTBEAT_INTERVAL_SECONDS=30