[yuval-k]

Instead of starting a pending enrollment, waiting for user OIDC sign-in and then finish the enrollment, we enroll after the user's OIDC sign-in is complete.

This removes the need to track pending enrollments on the controller: there is no longer a cap of 1,024 pending enrollments, and no in-memory enrollment state, so controller replicas don't need sticky routing.

Changes

• New RPCs GetLoginConfiguration (read-only) and EnrollDevice replace BeginEnrollment/CompleteEnrollment. Breaking: upgrade controller and agents together; there is no fallback.
• The agent runs the OIDC login itself (PKCE, state, nonce) and creates the device key/CSR only after sign-in. The controller verifies the ID token and access token as before, and accepts any valid tokens for its client rather than requiring a sign-in it started.
• Headless (device authorization) agents now call the IdP's device authorization endpoint directly.
• Migration 0005_enrollment_receipts: retries with the same user and CSR return the original device and certificate, including after a controller restart.
• The user-facing sign-in flow is unchanged.

Follow-up: #255.