Implement edge-host-self-enrollment

Host Agent:
- One-time local operator account bootstrap (PBKDF2-HMAC-SHA256, atomic
  0600-permission write) gating the daemon's first unattended start via a
  new `setup` CLI subcommand.
- Default control-plane URL now https://amcp.home.jerryyan.top (env var
  override unchanged).
- Enrollment no longer requires a pre-issued token; falls back to
  zero-token self-service enrollment when none is configured.

Cloud control plane:
- CLOUD_SELF_SERVICE_ENROLLMENT_ENABLED (default false) opt-in flag.
- SelfServiceEnrollmentAuthProvider + ChainedEnrollmentAuthProvider:
  configured tokens still take priority; self-service only applies when
  no token matches, preserving edge-host-enrollment's token-bound path.
- Fixed a latent bug in sql_repository.py::enroll_host: the token-conflict
  lookup used `== enrollment_token_digest`, which SQLAlchemy compiles to
  `IS NULL` when the value is None, so every self-service enrollment after
  the first would have falsely collided with an existing NULL-digest host.
  Skipped that lookup entirely when the digest is None.

Docs/deploy: .env.example, compose.yaml, compose.deploy.yaml,
CLOUD_DEPLOYMENT.md, MACOS_IPHONE_SETUP.md updated for the new flag,
URL default, and required `device-host-agent setup` step.

Verification: 494 non-integration tests pass; openspec validate --strict
passes. PostgreSQL-backed contract tests and full manual end-to-end
verification were not run (no Postgres/Docker or reachable cloud-api in
this environment); noted as unchecked in tasks.md 7.2/7.4.

apps/device-host-agent/tests/test_config.py

@@ -17,9 +17,9 @@ BASE_ENV = {
 }
 
 
-def test_load_host_agent_config_uses_local_network_defaults() -> None:
+def test_load_host_agent_config_uses_managed_cloud_default() -> None:
     assert load_host_agent_config(BASE_ENV) == HostAgentConfig(
-        control_plane_url="http://127.0.0.1:8001",
+        control_plane_url="https://amcp.home.jerryyan.top",
         host_id="host-a",
         token="secret",
     )
@@ -74,6 +74,27 @@ def test_existing_identity_state_allows_restart_without_enrollment_token(
     assert config.enrollment_managed is True
 
 
+def test_fresh_install_with_no_token_is_valid_and_defaults_local_account_path() -> None:
+    config = load_host_agent_config({"HOST_AGENT_CONTROL_PLANE_URL": "https://cloud.example"})
+
+    assert config.host_id == ""
+    assert config.enrollment_token == ""
+    assert config.enrollment_managed is True
+    assert config.local_account_path == Path("tasks/host_local_account.json")
+
+
+def test_local_account_path_can_be_overridden(tmp_path) -> None:
+    account_path = tmp_path / "account.json"
+    config = load_host_agent_config(
+        {
+            "HOST_AGENT_CONTROL_PLANE_URL": "https://cloud.example",
+            "HOST_AGENT_LOCAL_ACCOUNT_PATH": str(account_path),
+        }
+    )
+
+    assert config.local_account_path == account_path
+
+
 @pytest.mark.parametrize(
     "overrides",
     [