feat(federation): enrollment controller + single-use token flow (FED-M2-07)

Adds single-use enrollment token table, service, and controller enabling remote
peer gateways to enroll into a pending federation grant via CSR submission.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

packages/db/drizzle/meta/_journal.json

@@ -71,6 +71,13 @@
       "when": 1745280000000,
       "tag": "0009_federation_grant_pending",
       "breakpoints": true
+    },
+    {
+      "idx": 10,
+      "version": "7",
+      "when": 1745366400000,
+      "tag": "0010_federation_enrollment_tokens",
+      "breakpoints": true
     }
   ]
-}
+}