feat: add fixed portal installation enrollment

[ezutfen]

Summary

• Preserve the fixed three-client Portal installation contract.
• Add replay-safe atomic rotation for all three current credentials.
• Add owner-only irreversible enrollment termination.
• Add a bounded pairing-authenticated status response.
• Reject generic owner mutations that target enrolled authority.

Root cause

Migration 031 required one active, nonexpiring credential for each enrolled client. Deferred invariants also required all three clients and both grants to remain active. These rules made enrolled authority permanent.

Impact

• Portal can rotate the complete credential set without sending raw credentials to Core.
• Historical credentials remain revoked audit evidence.
• An owner can terminate all enrolled credentials, clients, grants, and delegated tokens in one transaction.
• Initial enrollment replay cannot reactivate terminated authority.
• Existing non-enrollment service-client behavior remains unchanged.

Validation

• Clean Compose CI: 3,107 root tests passed and 34 optional-path tests skipped.
• SDK: 55 tests passed.
• MCP adapter: 36 tests passed.
• Hooks adapter: 186 tests passed.
• Focused Portal enrollment suite: 35 tests passed.
• Ruff passed.
• Strict mypy passed.
• Repository, diff, database, container-log, and JUnit artifact credential scans passed.

This pull request remains draft. Do not merge it until the dependent Portal pull request is certified. Update its Core pin after this pull request merges.