feat(fleet): Attest RPC + enrollment write RPCs + managed-state config

[Bugs5382]

What and why

Phase 1 (contract) of FM enrollment slice B (manager #21) — the wire surface the engine, manager, and web consume in later phases.

• Node Attest(nonce) — the node signs a manager nonce with its CA identity key (challenge-response attestation). Response carries the ECDSA signature + the identity public key (PKIX/DER). ek_pub/ek_cert are reserved for v1.1 TPM-EK attestation (not populated in v1.0.0).
• Fleet write RPCs — CreateEnrollment / ApproveEnrollment / RejectEnrollment; EnrollmentRequest gains kind (LINK|SUBORDINATE) + pinned_key_sha256 (TOFU pin).
• MachineConfig.Management { manager_cn, trust_pem, operator_surface_readonly } — the LINK target, carried through ApplyConfig.
• Refreshed the FleetService doc to reflect read + write.

Contract-only; no behavior. Merge order: this lands first, then cryptos (Attest handler + config round-trip) → manager → web.

Closes #45

Verification

• buf generate produces Go + TS; only proto + generated files changed (13 files)
• go build ./... clean
• New surface present in generated code (Attest in NodeService; Create/Approve/Reject in fleetv1connect; Management in config.pb.go)