feat!: probes generate their own keys and enroll with a join token; node and peer keys are separate [CI]

backend/fleet/src/Fleet.Server.Enrollment/EnrollmentModels.cs

@@ -19,6 +19,13 @@ public sealed class EnrollRequest
     [JsonPropertyName("tls_spki")]
     public string TlsSpki { get; set; } = "";
 
+    /// <summary>
+    /// 同一把 TLS 密钥的完整公钥（SPKI，base64），必须和 <see cref="TlsSpki"/> 对得上。节点用这把密钥做对等面的签名认证
+    /// （和连服务端用的身份密钥是两把独立的密钥），对端要验签就需要完整的公钥，而不只是指纹。
+    /// </summary>
+    [JsonPropertyName("tls_pubkey")]
+    public string TlsPublicKey { get; set; } = "";
+
     /// <summary>持有证明：对 <c>fleet|v1|enroll|{sha256_hex(join_token)}|{pubkey}</c> 的签名（base64）。</summary>
     [JsonPropertyName("proof")]
     public string Proof { get; set; } = "";