[P1][Post-0.5][Full C] Add per-node bootstrap, identity rotation, and generation authorization

[mightnent]

Parent epic: #82

Outcome

Give every logical workspace node a distinct, rotatable, revocable workload identity bound to its current node generation, with an authenticated bootstrap flow that replaces manual credential and endpoint transcription.

Execution

• Priority: P1 post-0.5 Full C foundation.
• Deployment profiles: Hosted required; customer-managed remote nodes remain compatible.
• Worktree boundary: Bootstrap/claim API, node identity records, mTLS/application credentials, generation authorization, rotation/revocation, audit, and focused transport tests. Avoid placement, capacity scoring, migration, and cloud-specific provisioning.

Scope

• Create a short-lived, single-use bootstrap/claim flow tied to an expected logical node and deployment.
• Bind node API and application credentials to the logical node ID and current generation.
• Support certificate and credential rotation, revocation, expiry alarms, and CA-bundle rollover without fleet-wide downtime.
• Authorize heartbeat and lifecycle calls against both logical identity and current generation.
• Reject stale generations and two active controllers claiming the same node/storage generation.
• Keep node private keys and cloud credentials outside the product database and customer-visible surfaces.

Non-goals

• Selecting or provisioning cloud instances.
• Capacity measurement, placement policy, or workspace migration.
• Publishing private endpoints, certificate inventory, or infrastructure attachments to tenant sessions.

Definition of success

• Valid bootstrap creates or binds exactly one expected node identity and cannot be replayed.
• Invalid, expired, superseded, foreign-deployment, and already-consumed bootstrap material fails closed.
• Each node has distinct rotatable and revocable API/application credentials bound to its generation.
• Wrong node identity, wrong CA, expired/revoked certificate, wrong hostname, stale generation, and duplicate controller claims fail closed.
• Rotation and CA rollover preserve authorized service without accepting the retired identity beyond the documented overlap.
• No private key, application credential, bootstrap secret, or private endpoint reaches customer APIs, browsers, logs, or audit payloads.
• Focused controller/transport/security tests and npm run verify:quick pass on the exact candidate SHA.