Implement edge-host-self-enrollment

Host Agent:
- One-time local operator account bootstrap (PBKDF2-HMAC-SHA256, atomic
  0600-permission write) gating the daemon's first unattended start via a
  new `setup` CLI subcommand.
- Default control-plane URL now https://amcp.home.jerryyan.top (env var
  override unchanged).
- Enrollment no longer requires a pre-issued token; falls back to
  zero-token self-service enrollment when none is configured.

Cloud control plane:
- CLOUD_SELF_SERVICE_ENROLLMENT_ENABLED (default false) opt-in flag.
- SelfServiceEnrollmentAuthProvider + ChainedEnrollmentAuthProvider:
  configured tokens still take priority; self-service only applies when
  no token matches, preserving edge-host-enrollment's token-bound path.
- Fixed a latent bug in sql_repository.py::enroll_host: the token-conflict
  lookup used `== enrollment_token_digest`, which SQLAlchemy compiles to
  `IS NULL` when the value is None, so every self-service enrollment after
  the first would have falsely collided with an existing NULL-digest host.
  Skipped that lookup entirely when the digest is None.

Docs/deploy: .env.example, compose.yaml, compose.deploy.yaml,
CLOUD_DEPLOYMENT.md, MACOS_IPHONE_SETUP.md updated for the new flag,
URL default, and required `device-host-agent setup` step.

Verification: 494 non-integration tests pass; openspec validate --strict
passes. PostgreSQL-backed contract tests and full manual end-to-end
verification were not run (no Postgres/Docker or reachable cloud-api in
this environment); noted as unchecked in tasks.md 7.2/7.4.

apps/device-host-agent/host_agent/cli.py

@@ -1,12 +1,76 @@
 from __future__ import annotations
 
 import argparse
+import getpass
+import sys
 from collections.abc import Sequence
+from dataclasses import replace
 
 from host_agent.app import create_application
+from host_agent.config import load_host_agent_config
+from host_agent.local_account import LocalAccountStore
+
+
+class LocalAccountSetupError(RuntimeError):
+    """Raised when local account bootstrap cannot proceed."""
 
 
 def main(argv: Sequence[str] | None = None) -> None:
     parser = argparse.ArgumentParser(description="Run the Device Host Agent")
-    parser.parse_args(argv)
-    create_application().run()
+    subparsers = parser.add_subparsers(dest="command")
+    subparsers.add_parser("setup", help="Create the local operator account")
+    args = parser.parse_args(argv)
+
+    try:
+        if args.command == "setup":
+            _run_setup()
+            return
+        config = _resolve_config_with_local_account()
+    except LocalAccountSetupError as exc:
+        print(f"error: {exc}", file=sys.stderr)
+        raise SystemExit(1) from exc
+
+    create_application(config=config).run()
+
+
+def _run_setup() -> None:
+    config = load_host_agent_config()
+    store = LocalAccountStore(config.local_account_path)
+    if store.load() is not None:
+        confirm = input(
+            "A local account already exists. Overwrite it? [y/N] "
+        ).strip().lower()
+        if confirm != "y":
+            print("Setup cancelled; existing account left unchanged.")
+            return
+    account = _prompt_and_create(store)
+    print(f"Local account '{account.username}' created.")
+
+
+def _resolve_config_with_local_account():
+    config = load_host_agent_config()
+    store = LocalAccountStore(config.local_account_path)
+    account = store.load()
+    if account is None:
+        if not sys.stdin.isatty():
+            raise LocalAccountSetupError(
+                "no local account configured; run `device-host-agent setup` "
+                "on an interactive terminal to create one"
+            )
+        account = _prompt_and_create(store)
+    if not config.display_name:
+        config = replace(config, display_name=account.username)
+    return config
+
+
+def _prompt_and_create(store: LocalAccountStore):
+    username = input("Username: ").strip()
+    if not username:
+        raise LocalAccountSetupError("username must not be empty")
+    password = getpass.getpass("Password: ")
+    confirm = getpass.getpass("Confirm password: ")
+    if not password:
+        raise LocalAccountSetupError("password must not be empty")
+    if password != confirm:
+        raise LocalAccountSetupError("passwords do not match")
+    return store.create(username, password)