feat(canopy): add unregister command and stop resurrecting device keys

[passcod]

🤖 Resetting and re-enrolling a canopy server kept hitting a conflict because a leftover device key was being reused across every enrolment. This makes a fresh enrolment use only the new identity, adds a way to wipe every trace of an old one, and removes the DB-backed resurrection path that quietly brought old keys back.

canopy register

• Refuses when a registration already exists, directing the operator to run canopy unregister first, rather than silently reusing whatever identity is on disk.
• Always mints a fresh device key. Previously it reused a leftover key from an existing registration, so a re-enrolment would present a stale SPKI and conflict with the server record it was claiming.

canopy unregister (new)

Erases every place a canopy enrolment is stored:

• the encrypted registration (%ProgramData%\bestool / /etc/bestool, or a --config dir);
• the legacy plaintext identity files (device-key.pem, server-id);
• the cached tags (new and legacy locations);
• the legacy deviceKey / metaServerId rows in local_system_facts, gated on the database being reachable — skipped with a warning otherwise.

Prompts for confirmation, listing every target, with a -y/--yes bypass. Elevates up front to remove root/admin-owned files, matching register.

Stop reading the legacy DB rows

server_info no longer reads deviceKey / metaServerId from local_system_facts; identity now resolves from the registration, then the standard file, and nothing else. This removes the footgun where the daemon copied a stale deviceKey from the DB back onto disk, re-establishing an old identity even after the files were deleted. The rows are still deleted by unregister.

Move cached tags alongside the registration

Tags now cache next to the registration instead of in C:\Tamanu / /etc/tamanu. The legacy location is read as a fallback so a host that hasn't refreshed since the move keeps its cached tags until the next online fetch rewrites them.

Restart the daemon on an identity change

The daemon reads the device key and server id once at startup and caches them for its lifetime, so enrolling or unenrolling only takes effect once it restarts. register and unregister now ask a running daemon to restart via the existing /restart control endpoint, so it picks up the new identity (or drops the removed one) without a manual restart. Best-effort: a daemon that isn't running is fine — it reads the registration afresh on its next start. Only wired up when the daemon is built into the binary.

Notes

• Replaced the DB-backed get_or_create_server_id tests with file-based equivalents (no database needed now) and removed the write_device_key_file tests along with the function; added coverage for registration::delete_in and the tags legacy-fallback.