feat(web): toggle enrollment adapters live with honest engine-pending labeling

[Bugs5382]

What

Flips the enrollment-protocol adapter enable/disable toggle from mock-only to the live manager write path, and makes the control honest about what enabling means.

• lib/adapters.ts: setEnabled(kind, on) is now async and returns a write result. Mock mode is unchanged and coherent. Live mode resolves the adapter's name from the loaded live catalog (the web addresses adapters by kind; the RPC keys by name), calls SetAdapterEnabled({ name, enabled }), then refetches ListAdapters. If the adapter for the kind is not loaded it surfaces an inline error rather than sending an empty name.
• pages/protocols.tsx and pages/protocol-detail.tsx: admin-gate the toggle (non-admins see no writable control), await the write with a pending/disabled state, and render RPC errors inline (no native popups).
• A clear, persistent note on both pages: enabling records intent only; the ACME/EST/SCEP/Windows autoenrollment engines ship in a later release and an enabled adapter does not yet serve enrollment requests.
• Regenerated FleetService client types (src/gen) to include SetAdapterEnabled, synced from the api proto (feat(proto): add SetAdapterEnabled RPC api#62).

Merge order: depends on the manager write path (CryptOS-PKI/manager#50), which in turn depends on api#62. Merge api#62, then manager#50, then this. The live path is inert until the manager RPC exists; mock mode works standalone today.

Closes #64
Part of #24

Verification

• npm test: 178 passing (46 files), including new live-path and honest-note tests.
• npm run lint: clean (eslint + prettier).
• npm run build: succeeds.

How this was verified

Wrote a failing live-path test first (RPC called with the adapter NAME, not kind; inline error when unloaded; refetch after write), then implemented. Ran the full test suite, lint, and build locally.