feat(enroll): live enrollment queue — Create/Approve/Reject, LINK + attestation, level-gated

[Bugs5382]

What and why

Phase 4 (web) of FM enrollment slice B — the final piece. Turns the mock enrollment surface live against the manager's enrollment RPCs (#23).

• enrollment.ts: refreshed vendored api client; EnrollmentRequest gains kind (LINK|SUBORDINATE) + pinnedKeySha256; create/approve/reject await the live Connect RPCs in live/live-auth then re-pull the queue (mock path preserved). LINK approve carries the re-supplied connection material. getEnrollment now branches on fleetMode() so the detail page resolves live requests.
• Pages: operator-level-gated actions (viewer read-only; LINK approve requires admin; SUBORDINATE approve/reject operator+ — UX gating; the manager enforces for real); a New-enrollment create form (LINK: endpoint + admin cert/key/ca; SUBORDINATE: child/parent/profile); a LINK approval-material form; an attestation panel (kind + pinned identity); async await + inline error surfacing.

Closes #52

Verification

• npm run lint / test (134, incl. 17 enrollment page/data tests) / build — all green
• gating states (viewer/operator/admin), LINK material + create draft shapes, RPC args, and proto mapping all asserted

How this was verified

Whole-branch review confirmed the mock/live seam (separate stores, both branch on fleetMode, errors propagate), RPC wiring matches the generated proto field-for-field, level gating is consistent + honestly framed as UX (server enforces), and the tests are genuine (not render-only). Follow-up (Minor, pre-existing + shared with node-detail): live deep-link to a detail page needs a loading state instead of bouncing before the first poll resolves.