refactor: introduce agent authority lifecycle

[ZingerLittleBee]

Summary

• make AgentAuthority the single owner of Agent enrollment, run-token authority, offer lifecycle, audit history, and connection fencing
• replace fingerprint/rebind flows with agent-staged random run tokens, exact offer CAS, and explicit graceful or emergency re-enrollment
• extract idempotent server onboarding and route registration, REST, WebSocket, background tasks, and projections through the new authority boundary
• update the Web and iOS lifecycle UI, generated API types, bilingual documentation, architecture records, and manual regression runbooks
• remove the Agent fingerprint model without retaining a compatibility path, and fix the Docker healthcheck to use an explicit IPv4 endpoint

Validation

• cargo fmt
• cargo clippy --all --benches --tests --examples --all-features
• Rust suites: common (149), agent (862), server library (1,503), and all 42 server integration targets
• Web: 690 Vitest tests across 96 files, TypeScript typecheck, and Ultracite
• iOS: 245 tests
• docs, shell syntax/ShellCheck, and generated JSON validation
• real Debian 13 VPS regression using macOS-cross-built amd64 binaries: HTTPS deployment, Docker and systemd Agent installs, graceful/emergency re-enrollment, stale-offer conflict, old-token 401 fencing, offer/authority revocation separation, audit-secret checks, and full purge cleanup

Deployment note

The Agent Authority database migration is intentionally up-only. Enrollment codes and run tokens remain one-way credentials; event history contains lifecycle metadata only.