feat: every agent and probe must have an owner passkey, enforced by the panel, the installers and fleet-enroll [CI]

web/admin/src/pages/Agents.tsx

@@ -50,7 +50,7 @@ function AddAgentDialog({ onClose, onCreated }: { onClose: () => void; onCreated
           <button
             type="button"
             className="btn primary"
-            disabled={busy}
+            disabled={busy || !controllers?.length}
             onClick={async () => {
               await run(async () => {
                 const token = await api.post<CreatedJoinTokenDto>('/api/admin/join-tokens', {
@@ -92,7 +92,7 @@ function AddAgentDialog({ onClose, onCreated }: { onClose: () => void; onCreated
           <input className="input" type="number" min={1} max={720} value={hours} onChange={(e) => setHours(Number(e.target.value))} />
         </Field>
         <div className="wide">
-          <Field label="属主（passkey）" hint="允许授权这个节点 web ssh 等敏感操作的 Passkey；只是选，不用触碰。装上后固定在节点本地，面板改不了。">
+          <Field label="属主（passkey）" hint="必选（至少一把）：这个节点的敏感操作（web ssh 等）和加密内容只认它们。只是选，不用触碰；装上后固定在节点本地，面板改不了。">
             <OwnerPicker value={controllers} onChange={setControllers} />
           </Field>
         </div>