feat: client enrollment API and compute entity provisioning

Phase 1 implementation from the client-lifecycle plan.

- Migration 012: provisioning_steps table, context_version, context_files,
  enrolled_at column, slug+type index for machine entities
- API endpoints (openapi.yaml + generated code):
  POST /clients/enroll — age key issuance, Infisical identity, state transition
  GET /clients/{slug}/context — agent file delta polling (replaces git pull)
  GET /clients/{slug}/secrets — scoped secret listing
  POST /entities/provision — compute entity creation with constraint validation
  GET /entities/{slug}/provision/status — step-by-step provisioning progress
- Handlers in impl.go: enrollment with state validation and age key generation,
  provisioning with execution tracking and relationship creation,
  context endpoint with since-based delta queries
- Server struct extended with secretsBackend interface for key storage
- All tests pass, build clean

internal/httpapi/server.go

@@ -44,11 +44,19 @@ type actor struct {
 
 // Server implements gen.StrictServerInterface over the DB layer.
 type Server struct {
-	pool     *db.Pool
-	cfg      config.Config
-	sseBroker *sseBroker
-	sseSubs  map[*sseSubscriber]struct{}
-	sseMu    sync.Mutex
+	pool           *db.Pool
+	cfg            config.Config
+	secretsManager secretsBackend
+	sseBroker      *sseBroker
+	sseSubs        map[*sseSubscriber]struct{}
+	sseMu          sync.Mutex
+}
+
+// secretsBackend is a minimal interface for secrets operations used by the
+// HTTP API (enrollment key storage, listing). Compatible with internal/secrets.
+type secretsBackend interface {
+	Set(ctx context.Context, key string, value string) error
+	List(ctx context.Context) ([]string, error)
 }
 
 // NewHandler builds the full HTTP handler: /healthz (unauthenticated,