feat: add self-enrollment workflow for automated PKI provisioning

- Phase 1: CLI args (--enroll flag), enroll module skeleton, config support
- Phase 2: Registration request, polling loop (24h timeout), main.rs integration
- Phase 3: PKI extraction, atomic cert writing, whitelist auto-append, mTLS transition
- Phase 4: E2E test suite, README/DEPLOYMENT docs, CI pipeline
- Phase 5: SPEC.md, API_DOCUMENTATION.md, CHANGELOG.md, ROADMAP.md sync

Security review: APPROVED (0 critical, 0 high findings)
Cross-distro compatible: Debian/Ubuntu, RHEL/CentOS/Fedora, Alpine, Arch Linux

.gitea/workflows/ci.yml

@@ -54,7 +54,7 @@ jobs:
         run: cargo clippy --all-targets --all-features -- -D warnings
 
   test:
-    name: Unit Tests
+    name: All Unit Tests
     runs-on: ubuntu-24.04
     steps:
       - name: Checkout repository
@@ -99,9 +99,61 @@ jobs:
           cargo install cargo-audit
           cargo audit --ignore RUSTSEC-2025-0134
 
+  enrollment-tests:
+    name: Enrollment Tests
+    needs: [fmt, clippy]
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout repository
+        run: |
+          curl -sfL -H "Authorization: token ${{ secrets.GITEATOKEN }}" "https://gitea-lxc.moon-dragon.us/echo/linux_patch_api/archive/${GITHUB_SHA}.tar.gz" -o repo.tar.gz
+          tar -xzf repo.tar.gz --strip-components=1
+          rm -f repo.tar.gz
+      - name: Install Rust
+        run: |
+          curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain stable --profile minimal
+          . "$HOME/.cargo/env"
+          echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
+      - name: Install system dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get -f install -y
+          sudo apt-get install -y build-essential libsystemd-dev pkg-config
+      - name: Run enrollment unit tests
+        run: cargo test --test enroll_identity
+      - name: Run enrollment integration tests
+        run: cargo test --test enrollment_test
+      - name: Run enrollment E2E tests
+        run: cargo test --test enrollment_e2e
+
+  verify-enrollment-cli:
+    name: Verify Enrollment CLI Flag
+    needs: [clippy]
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout repository
+        run: |
+          curl -sfL -H "Authorization: token ${{ secrets.GITEATOKEN }}" "https://gitea-lxc.moon-dragon.us/echo/linux_patch_api/archive/${GITHUB_SHA}.tar.gz" -o repo.tar.gz
+          tar -xzf repo.tar.gz --strip-components=1
+          rm -f repo.tar.gz
+      - name: Install Rust
+        run: |
+          curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain stable --profile minimal
+          . "$HOME/.cargo/env"
+          echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
+      - name: Install system dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get -f install -y
+          sudo apt-get install -y build-essential libsystemd-dev pkg-config
+      - name: Build binary
+        run: cargo build
+      - name: Verify --enroll flag exists
+        run: cargo run -- --help | grep -q '\-\-enroll'
+
   build-deb:
     name: Build Debian Package
-    needs: [fmt, clippy, test]
+    needs: [fmt, clippy, test, enrollment-tests]
     runs-on: ubuntu-24.04
     steps:
       - name: Checkout repository
@@ -134,7 +186,7 @@ jobs:
 
   build-deb-u2204:
     name: Build Debian Package (Ubuntu 22.04)
-    needs: [fmt, clippy, test]
+    needs: [fmt, clippy, test, enrollment-tests]
     runs-on: ubuntu-22.04
     steps:
       - name: Checkout repository
@@ -173,7 +225,7 @@ jobs:
 
   build-rpm:
     name: Build RPM Package
-    needs: [fmt, clippy, test]
+    needs: [fmt, clippy, test, enrollment-tests]
     runs-on: fedora
     steps:
       - name: Checkout repository
@@ -207,7 +259,7 @@ jobs:
 
   build-apk:
     name: Build Alpine Package
-    needs: [fmt, clippy, test]
+    needs: [fmt, clippy, test, enrollment-tests]
     runs-on: alpine
     steps:
       - name: Checkout repository
@@ -244,7 +296,7 @@ jobs:
 
   build-arch:
     name: Build Arch Package
-    needs: [fmt, clippy, test]
+    needs: [fmt, clippy, test, enrollment-tests]
     runs-on: arch
     steps:
       - name: Checkout repository