Implement edge-host-self-enrollment

Host Agent:
- One-time local operator account bootstrap (PBKDF2-HMAC-SHA256, atomic
  0600-permission write) gating the daemon's first unattended start via a
  new `setup` CLI subcommand.
- Default control-plane URL now https://amcp.home.jerryyan.top (env var
  override unchanged).
- Enrollment no longer requires a pre-issued token; falls back to
  zero-token self-service enrollment when none is configured.

Cloud control plane:
- CLOUD_SELF_SERVICE_ENROLLMENT_ENABLED (default false) opt-in flag.
- SelfServiceEnrollmentAuthProvider + ChainedEnrollmentAuthProvider:
  configured tokens still take priority; self-service only applies when
  no token matches, preserving edge-host-enrollment's token-bound path.
- Fixed a latent bug in sql_repository.py::enroll_host: the token-conflict
  lookup used `== enrollment_token_digest`, which SQLAlchemy compiles to
  `IS NULL` when the value is None, so every self-service enrollment after
  the first would have falsely collided with an existing NULL-digest host.
  Skipped that lookup entirely when the digest is None.

Docs/deploy: .env.example, compose.yaml, compose.deploy.yaml,
CLOUD_DEPLOYMENT.md, MACOS_IPHONE_SETUP.md updated for the new flag,
URL default, and required `device-host-agent setup` step.

Verification: 494 non-integration tests pass; openspec validate --strict
passes. PostgreSQL-backed contract tests and full manual end-to-end
verification were not run (no Postgres/Docker or reachable cloud-api in
this environment); noted as unchecked in tasks.md 7.2/7.4.

packages/cloud-platform/cloud/auth.py

@@ -99,7 +99,12 @@ class EnrollmentCredential:
 @dataclass(frozen=True)
 class EnrollmentPrincipal:
     id: str
-    token_digest: str = field(repr=False)
+    token_digest: str | None = field(default=None, repr=False)
+
+
+@runtime_checkable
+class EnrollmentAuthProvider(Protocol):
+    def authenticate(self, request: object) -> EnrollmentPrincipal | None: ...
 
 
 class ConfiguredBearerAuthProvider:
@@ -156,6 +161,25 @@ class ConfiguredEnrollmentTokenProvider:
         return matched
 
 
+class SelfServiceEnrollmentAuthProvider:
+    """Unconditionally authorizes Host enrollment with no pre-issued token."""
+
+    def authenticate(self, request: object) -> EnrollmentPrincipal | None:
+        return EnrollmentPrincipal(id="self-service", token_digest=None)
+
+
+class ChainedEnrollmentAuthProvider:
+    def __init__(self, providers: Iterable[EnrollmentAuthProvider]) -> None:
+        self.providers = tuple(providers)
+
+    def authenticate(self, request: object) -> EnrollmentPrincipal | None:
+        for provider in self.providers:
+            principal = provider.authenticate(request)
+            if principal is not None:
+                return principal
+        return None
+
+
 class RepositoryHostAuthProvider:
     def __init__(self, repository: CloudRepository) -> None:
         self.repository = repository

packages/cloud-platform/cloud/control_config.py

@@ -32,6 +32,7 @@ class CloudControlConfig:
     allow_insecure_anonymous: bool = False
     credentials: tuple[BearerCredential, ...] = ()
     enrollment_credentials: tuple[EnrollmentCredential, ...] = ()
+    self_service_enrollment_enabled: bool = False
     cors_allowed_origins: tuple[str, ...] = ()
     console_static_dir: str | None = None
     user_session_idle_seconds: int = 28_800
@@ -99,6 +100,10 @@ def load_control_config(
         enrollment_credentials=_parse_enrollment_credentials(
             values.get("CLOUD_ENROLLMENT_TOKENS_JSON")
         ),
+        self_service_enrollment_enabled=_parse_bool(
+            values.get("CLOUD_SELF_SERVICE_ENROLLMENT_ENABLED"),
+            default=False,
+        ),
         cors_allowed_origins=_parse_cors_origins(
             values.get("CLOUD_CONSOLE_CORS_ORIGINS")
         ),

packages/cloud-platform/cloud/internal_api/api.py

@@ -13,6 +13,7 @@ from fastapi.responses import JSONResponse
 from cloud.auth import (
     AuthProvider,
     ConfiguredEnrollmentTokenProvider,
+    EnrollmentAuthProvider,
     HostAuthorizationError,
     digest_token,
 )
@@ -47,7 +48,7 @@ def create_internal_router(
     *,
     pool: DevicePool,
     auth_provider: AuthProvider,
-    enrollment_auth_provider: ConfiguredEnrollmentTokenProvider | None = None,
+    enrollment_auth_provider: EnrollmentAuthProvider | None = None,
     version_prefix: str = "/internal/v1",
     claim_poll_interval_seconds: float = 0.1,
     lease_duration_seconds: float = 60.0,

packages/cloud-platform/cloud/repository.py

@@ -100,7 +100,7 @@ class CloudRepository(Protocol):
         host_id: str,
         agent_instance_id: str,
         credential_digest: str,
-        enrollment_token_digest: str,
+        enrollment_token_digest: str | None,
         display_name: str | None,
         enrolled_at: datetime,
     ) -> HostEnrollment: ...

packages/cloud-platform/cloud/sql_repository.py

@@ -45,7 +45,7 @@ class SQLAlchemyCloudRepository:
         host_id: str,
         agent_instance_id: str,
         credential_digest: str,
-        enrollment_token_digest: str,
+        enrollment_token_digest: str | None,
         display_name: str | None,
         enrolled_at: datetime,
     ) -> Any:
@@ -72,11 +72,19 @@ class SQLAlchemyCloudRepository:
                         )
                     return _host_enrollment_from_row(existing)
 
-                token_owner = session.scalars(
-                    select(HostRow).where(
-                        HostRow.enrollment_token_digest == enrollment_token_digest
-                    )
-                ).first()
+                # A NULL enrollment_token_digest marks self-service Hosts, which
+                # never bind a shared token; comparing `== NULL` would otherwise
+                # match every other self-service Host via SQL's `IS NULL` and
+                # falsely report a token conflict.
+                token_owner = (
+                    session.scalars(
+                        select(HostRow).where(
+                            HostRow.enrollment_token_digest == enrollment_token_digest
+                        )
+                    ).first()
+                    if enrollment_token_digest is not None
+                    else None
+                )
                 if token_owner is not None:
                     raise EnrollmentTokenConflictError(
                         "enrollment token is already bound to another Host"
@@ -109,11 +117,15 @@ class SQLAlchemyCloudRepository:
                     and existing.enrollment_token_digest == enrollment_token_digest
                 ):
                     return _host_enrollment_from_row(existing)
-                token_owner = session.scalars(
-                    select(HostRow).where(
-                        HostRow.enrollment_token_digest == enrollment_token_digest
-                    )
-                ).first()
+                token_owner = (
+                    session.scalars(
+                        select(HostRow).where(
+                            HostRow.enrollment_token_digest == enrollment_token_digest
+                        )
+                    ).first()
+                    if enrollment_token_digest is not None
+                    else None
+                )
             if token_owner is not None:
                 raise EnrollmentTokenConflictError(
                     "enrollment token is already bound to another Host"