enroll: spool a token minted outside the server, adopted on first use

A second process cannot append a token to the config: the server holds
its config in memory and writes it back whole, so the append loses the
race with the next save, silently. spool_pending writes one file per
token, named by the hash, into a private directory; take_pending lets
the running server move it into its own config the first time the phone
presents it, and sweeps anything older than an hour unused. This is what
lets a tool -- Dev Updater -- ask for an enrolment link without being at
the terminal the QR is printed on.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

server/src/certs.rs

@@ -155,10 +155,7 @@ mod tests {
     }
 
     fn addresses() -> Vec<IpAddr> {
-        vec![
-            "192.168.1.5".parse().unwrap(),
-            "127.0.0.1".parse().unwrap(),
-        ]
+        vec!["192.168.1.5".parse().unwrap(), "127.0.0.1".parse().unwrap()]
     }
 
     #[test]