Implement edge-host-self-enrollment

Host Agent:
- One-time local operator account bootstrap (PBKDF2-HMAC-SHA256, atomic
  0600-permission write) gating the daemon's first unattended start via a
  new `setup` CLI subcommand.
- Default control-plane URL now https://amcp.home.jerryyan.top (env var
  override unchanged).
- Enrollment no longer requires a pre-issued token; falls back to
  zero-token self-service enrollment when none is configured.

Cloud control plane:
- CLOUD_SELF_SERVICE_ENROLLMENT_ENABLED (default false) opt-in flag.
- SelfServiceEnrollmentAuthProvider + ChainedEnrollmentAuthProvider:
  configured tokens still take priority; self-service only applies when
  no token matches, preserving edge-host-enrollment's token-bound path.
- Fixed a latent bug in sql_repository.py::enroll_host: the token-conflict
  lookup used `== enrollment_token_digest`, which SQLAlchemy compiles to
  `IS NULL` when the value is None, so every self-service enrollment after
  the first would have falsely collided with an existing NULL-digest host.
  Skipped that lookup entirely when the digest is None.

Docs/deploy: .env.example, compose.yaml, compose.deploy.yaml,
CLOUD_DEPLOYMENT.md, MACOS_IPHONE_SETUP.md updated for the new flag,
URL default, and required `device-host-agent setup` step.

Verification: 494 non-integration tests pass; openspec validate --strict
passes. PostgreSQL-backed contract tests and full manual end-to-end
verification were not run (no Postgres/Docker or reachable cloud-api in
this environment); noted as unchecked in tasks.md 7.2/7.4.

apps/device-host-agent/host_agent/client.py

@@ -53,12 +53,10 @@ class HostAgentEnrollmentClient:
         host_token: str,
         display_name: str | None,
     ) -> HostEnrollmentResponse:
-        if not self.config.enrollment_token:
-            raise HostAgentAPIError(0, "Host enrollment token is unavailable")
         response = self._request(
             "POST",
             "/internal/v1/enrollments",
-            token=self.config.enrollment_token,
+            token=self.config.enrollment_token or None,
             json={
                 "agent_instance_id": agent_instance_id,
                 "host_token": host_token,
@@ -99,9 +97,10 @@ class HostAgentEnrollmentClient:
         method: str,
         path: str,
         *,
-        token: str,
+        token: str | None,
         json: dict[str, Any],
     ) -> httpx.Response:
+        headers = {"Authorization": f"Bearer {token}"} if token else {}
         backoff = self.config.retry_backoff_seconds
         for attempt in range(1, self.config.max_retry_attempts + 1):
             try:
@@ -109,7 +108,7 @@ class HostAgentEnrollmentClient:
                     method,
                     path,
                     json=json,
-                    headers={"Authorization": f"Bearer {token}"},
+                    headers=headers,
                 )
             except httpx.TransportError:
                 if attempt == self.config.max_retry_attempts: