feat!: genesis-pinned operator set, server identity with an encrypted control link, key-less join codes; release key continuity

Join codes need no passkey touch and carry only public values (genesis
fingerprint, owner credentials, installer hashes). Nodes pin the genesis and
owners at enrollment and only follow passkey-signed operator set versions.
The panel's server key is listed in the set; pinned nodes require its
signature and run the control link under AES-256-GCM. Password sessions carry
no capabilities. The updater adopts a next_key from a signed manifest.

Bump version to 0.2.0. [CI SKIP]

backend/src/MoShiro.Backend.Application/Auth/Capabilities.cs

@@ -59,7 +59,7 @@ public static class CapabilityCatalog
 
         new(Capability.FleetRead, "fleet"),
         new(Capability.FleetWrite, "fleet", false, false, Capability.FleetRead),
-        new(Capability.FleetEnroll, "fleet", true, false, Capability.FleetRead),
+        new(Capability.FleetEnroll, "fleet", false, false, Capability.FleetRead),
         new(Capability.FleetRevoke, "fleet", true, false, Capability.FleetRead),
 
         new(Capability.TasksRead, "tasks"),
@@ -134,4 +134,10 @@ public static class CapabilityCatalog
 
     /// <summary>登录会话的能力：全部，包括信任类；信任类的操作还要有效的提权窗口（<see cref="ElevationService"/>）。</summary>
     public static IReadOnlyList<string> ForSession() => [.. All.Select(c => c.Id)];
+
+    /// <summary>
+    /// 按登录方式给会话能力：passkey 登录的拿全部；<b>密码登录的什么能力都没有</b>，只能做「已登录」就能做的事——
+    /// 看自己是谁、注册自己的第一个 passkey。管理员要先用密码进来加一个 passkey，之后用 passkey 登录才能管事。
+    /// </summary>
+    public static IReadOnlyList<string> ForSession(string authMethod) => authMethod == AuthMethods.Passkey ? ForSession() : [];
 }