feat(federation): enrollment controller + single-use token flow (FED-M2-07)

Adds single-use enrollment token table, service, and controller enabling remote
peer gateways to enroll into a pending federation grant via CSR submission.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

apps/gateway/src/federation/federation.module.ts

@@ -1,9 +1,13 @@
 import { Module } from '@nestjs/common';
+import { AdminGuard } from '../admin/admin.guard.js';
 import { CaService } from './ca.service.js';
+import { EnrollmentController } from './enrollment.controller.js';
+import { EnrollmentService } from './enrollment.service.js';
 import { GrantsService } from './grants.service.js';
 
 @Module({
-  providers: [CaService, GrantsService],
-  exports: [CaService, GrantsService],
+  controllers: [EnrollmentController],
+  providers: [AdminGuard, CaService, EnrollmentService, GrantsService],
+  exports: [CaService, EnrollmentService, GrantsService],
 })
 export class FederationModule {}