feat: client enrollment API and compute entity provisioning

Phase 1 implementation from the client-lifecycle plan.

- Migration 012: provisioning_steps table, context_version, context_files,
  enrolled_at column, slug+type index for machine entities
- API endpoints (openapi.yaml + generated code):
  POST /clients/enroll — age key issuance, Infisical identity, state transition
  GET /clients/{slug}/context — agent file delta polling (replaces git pull)
  GET /clients/{slug}/secrets — scoped secret listing
  POST /entities/provision — compute entity creation with constraint validation
  GET /entities/{slug}/provision/status — step-by-step provisioning progress
- Handlers in impl.go: enrollment with state validation and age key generation,
  provisioning with execution tracking and relationship creation,
  context endpoint with since-based delta queries
- Server struct extended with secretsBackend interface for key storage
- All tests pass, build clean

internal/db/sqlcgen/entities.sql.go

@@ -14,7 +14,7 @@ import (
 
 const getEntityByID = `-- name: GetEntityByID :one
 
-SELECT e.id, e.slug, e.type, e.name, e.state, e.attributes, e.maintenance_until, e.version, e.created_at, e.updated_at FROM entities e WHERE e.id = $1
+SELECT e.id, e.slug, e.type, e.name, e.state, e.attributes, e.maintenance_until, e.version, e.created_at, e.updated_at, e.enrolled_at, e.enrolled_by FROM entities e WHERE e.id = $1
 `
 
 // Entity read + mutation queries (API paths). Aliased `e` throughout to
@@ -33,12 +33,14 @@ func (q *Queries) GetEntityByID(ctx context.Context, id uuid.UUID) (Entity, erro
 		&i.Version,
 		&i.CreatedAt,
 		&i.UpdatedAt,
+		&i.EnrolledAt,
+		&i.EnrolledBy,
 	)
 	return i, err
 }
 
 const getEntityBySlug = `-- name: GetEntityBySlug :one
-SELECT e.id, e.slug, e.type, e.name, e.state, e.attributes, e.maintenance_until, e.version, e.created_at, e.updated_at FROM entities e WHERE e.slug = $1
+SELECT e.id, e.slug, e.type, e.name, e.state, e.attributes, e.maintenance_until, e.version, e.created_at, e.updated_at, e.enrolled_at, e.enrolled_by FROM entities e WHERE e.slug = $1
 `
 
 func (q *Queries) GetEntityBySlug(ctx context.Context, slug string) (Entity, error) {
@@ -55,6 +57,8 @@ func (q *Queries) GetEntityBySlug(ctx context.Context, slug string) (Entity, err
 		&i.Version,
 		&i.CreatedAt,
 		&i.UpdatedAt,
+		&i.EnrolledAt,
+		&i.EnrolledBy,
 	)
 	return i, err
 }
@@ -62,7 +66,7 @@ func (q *Queries) GetEntityBySlug(ctx context.Context, slug string) (Entity, err
 const insertEntity = `-- name: InsertEntity :one
 INSERT INTO entities (id, slug, type, name, state, attributes)
 VALUES ($1, $2, $3, $4, $5, $6)
-RETURNING id, slug, type, name, state, attributes, maintenance_until, version, created_at, updated_at
+RETURNING id, slug, type, name, state, attributes, maintenance_until, version, created_at, updated_at, enrolled_at, enrolled_by
 `
 
 type InsertEntityParams struct {
@@ -95,6 +99,8 @@ func (q *Queries) InsertEntity(ctx context.Context, arg InsertEntityParams) (Ent
 		&i.Version,
 		&i.CreatedAt,
 		&i.UpdatedAt,
+		&i.EnrolledAt,
+		&i.EnrolledBy,
 	)
 	return i, err
 }
@@ -106,7 +112,7 @@ WITH RECURSIVE tt AS (
     SELECT et.name FROM entity_types et JOIN tt ON et.parent_type = tt.name
     WHERE $7::text IS NOT NULL
 )
-SELECT e.id, e.slug, e.type, e.name, e.state, e.attributes, e.maintenance_until, e.version, e.created_at, e.updated_at FROM entities e
+SELECT e.id, e.slug, e.type, e.name, e.state, e.attributes, e.maintenance_until, e.version, e.created_at, e.updated_at, e.enrolled_at, e.enrolled_by FROM entities e
 JOIN entity_types et ON et.name = e.type
 WHERE e.type IN (SELECT name FROM tt)
   AND ($1::text IS NULL OR e.state = $1)
@@ -158,6 +164,8 @@ func (q *Queries) ListEntities(ctx context.Context, arg ListEntitiesParams) ([]E
 			&i.Version,
 			&i.CreatedAt,
 			&i.UpdatedAt,
+			&i.EnrolledAt,
+			&i.EnrolledBy,
 		); err != nil {
 			return nil, err
 		}
@@ -170,7 +178,7 @@ func (q *Queries) ListEntities(ctx context.Context, arg ListEntitiesParams) ([]E
 }
 
 const listEntitiesCapped = `-- name: ListEntitiesCapped :many
-SELECT e.id, e.slug, e.type, e.name, e.state, e.attributes, e.maintenance_until, e.version, e.created_at, e.updated_at FROM entities e ORDER BY e.slug LIMIT $1
+SELECT e.id, e.slug, e.type, e.name, e.state, e.attributes, e.maintenance_until, e.version, e.created_at, e.updated_at, e.enrolled_at, e.enrolled_by FROM entities e ORDER BY e.slug LIMIT $1
 `
 
 func (q *Queries) ListEntitiesCapped(ctx context.Context, limit int32) ([]Entity, error) {
@@ -193,6 +201,8 @@ func (q *Queries) ListEntitiesCapped(ctx context.Context, limit int32) ([]Entity
 			&i.Version,
 			&i.CreatedAt,
 			&i.UpdatedAt,
+			&i.EnrolledAt,
+			&i.EnrolledBy,
 		); err != nil {
 			return nil, err
 		}
@@ -214,7 +224,7 @@ UPDATE entities SET
     version = version + 1,
     updated_at = now()
 WHERE id = $6 AND version = $7
-RETURNING id, slug, type, name, state, attributes, maintenance_until, version, created_at, updated_at
+RETURNING id, slug, type, name, state, attributes, maintenance_until, version, created_at, updated_at, enrolled_at, enrolled_by
 `
 
 type UpdateEntityParams struct {
@@ -249,6 +259,8 @@ func (q *Queries) UpdateEntity(ctx context.Context, arg UpdateEntityParams) (Ent
 		&i.Version,
 		&i.CreatedAt,
 		&i.UpdatedAt,
+		&i.EnrolledAt,
+		&i.EnrolledBy,
 	)
 	return i, err
 }

internal/db/sqlcgen/models.go

@@ -104,6 +104,18 @@ type Classification struct {
 	CreatedAt         time.Time
 }
 
+type ContextFile struct {
+	Path        string
+	Hash        string
+	LastChanged time.Time
+}
+
+type ContextVersion struct {
+	Singleton bool
+	Version   int64
+	UpdatedAt time.Time
+}
+
 type Entity struct {
 	ID               uuid.UUID
 	Slug             string
@@ -115,6 +127,8 @@ type Entity struct {
 	Version          int32
 	CreatedAt        time.Time
 	UpdatedAt        time.Time
+	EnrolledAt       *time.Time
+	EnrolledBy       *uuid.UUID
 }
 
 type EntityStatus struct {
@@ -192,6 +206,18 @@ type IdempotencyKey struct {
 	CreatedAt    time.Time
 }
 
+type KnowledgeEntity struct {
+	EntityID    uuid.UUID
+	Title       string
+	Content     string
+	Source      *string
+	Tags        []string
+	CreatedAt   time.Time
+	UpdatedAt   time.Time
+	ContentHash *string
+	Search      interface{}
+}
+
 type Ledger struct {
 	Ts             time.Time
 	ExecutionID    uuid.UUID
@@ -261,6 +287,20 @@ type Pattern struct {
 	CreatedAt       time.Time
 }
 
+type ProvisioningStep struct {
+	ID           uuid.UUID
+	EntityID     uuid.UUID
+	ExecutionID  uuid.UUID
+	StepOrder    int32
+	StepName     string
+	Status       string
+	StartedAt    *time.Time
+	FinishedAt   *time.Time
+	ErrorMessage *string
+	CreatedAt    time.Time
+	UpdatedAt    time.Time
+}
+
 type Relationship struct {
 	SourceID   uuid.UUID
 	TargetID   uuid.UUID