Implement edge-host-self-enrollment

Host Agent:
- One-time local operator account bootstrap (PBKDF2-HMAC-SHA256, atomic
  0600-permission write) gating the daemon's first unattended start via a
  new `setup` CLI subcommand.
- Default control-plane URL now https://amcp.home.jerryyan.top (env var
  override unchanged).
- Enrollment no longer requires a pre-issued token; falls back to
  zero-token self-service enrollment when none is configured.

Cloud control plane:
- CLOUD_SELF_SERVICE_ENROLLMENT_ENABLED (default false) opt-in flag.
- SelfServiceEnrollmentAuthProvider + ChainedEnrollmentAuthProvider:
  configured tokens still take priority; self-service only applies when
  no token matches, preserving edge-host-enrollment's token-bound path.
- Fixed a latent bug in sql_repository.py::enroll_host: the token-conflict
  lookup used `== enrollment_token_digest`, which SQLAlchemy compiles to
  `IS NULL` when the value is None, so every self-service enrollment after
  the first would have falsely collided with an existing NULL-digest host.
  Skipped that lookup entirely when the digest is None.

Docs/deploy: .env.example, compose.yaml, compose.deploy.yaml,
CLOUD_DEPLOYMENT.md, MACOS_IPHONE_SETUP.md updated for the new flag,
URL default, and required `device-host-agent setup` step.

Verification: 494 non-integration tests pass; openspec validate --strict
passes. PostgreSQL-backed contract tests and full manual end-to-end
verification were not run (no Postgres/Docker or reachable cloud-api in
this environment); noted as unchecked in tasks.md 7.2/7.4.

apps/device-host-agent/host_agent/config.py

@@ -18,6 +18,7 @@ class HostAgentConfig:
     token: str = field(default="", repr=False)
     enrollment_token: str = field(default="", repr=False)
     identity_path: Path = Path("tasks/host_identity.json")
+    local_account_path: Path = Path("tasks/host_local_account.json")
     enrollment_managed: bool = False
     display_name: str | None = None
     heartbeat_interval_seconds: float = 30.0
@@ -34,7 +35,7 @@ def load_host_agent_config(
     control_plane_url = (
         values.get(
             "HOST_AGENT_CONTROL_PLANE_URL",
-            "http://127.0.0.1:8001",
+            "https://amcp.home.jerryyan.top",
         )
         .strip()
         .rstrip("/")
@@ -55,11 +56,11 @@ def load_host_agent_config(
     identity_path = Path(
         values.get("HOST_AGENT_IDENTITY_PATH", "tasks/host_identity.json").strip()
     )
-    if not host_id and not enrollment_token and not identity_path.is_file():
-        raise HostAgentConfigurationError(
-            "explicit Host credentials, an enrollment token, or existing identity state "
-            "is required"
-        )
+    local_account_path = Path(
+        values.get(
+            "HOST_AGENT_LOCAL_ACCOUNT_PATH", "tasks/host_local_account.json"
+        ).strip()
+    )
 
     config = HostAgentConfig(
         control_plane_url=control_plane_url,
@@ -67,6 +68,7 @@ def load_host_agent_config(
         token=token,
         enrollment_token=enrollment_token,
         identity_path=identity_path,
+        local_account_path=local_account_path,
         enrollment_managed=not bool(host_id),
         display_name=values.get("HOST_AGENT_DISPLAY_NAME") or None,
         heartbeat_interval_seconds=_positive_float(