[kipavy]

Gives the app what it needs to show someone the state of their own enrolment request, and to tell an unknown token apart from a server that predates enrolment. Part of VoltiusApp/voltius#757 (the voltius-cli enroll and "Sign in to " work).

What changes:

• Unknown id or wrong secret on resolve, redeem and register now answers 404 with {"error": "ENROLLMENT_NOT_FOUND"}. A bare 404 is left to mean "this server has no enrolment routes". Admin approve and deny keep their plain 404 for a request that is already gone.
• resolve, redeem and the register enrollment object now include team_id, so the client matches teams by id rather than by name. approve still returns the bare outcome.
• New GET /v1/enrollment/requests (signed in): the caller's own requests, newest per team, pending or denied within the last 30 days, leaving out teams they already belong to. It sits outside the team-invites switch because it only reads the caller's own rows.
• The requester gets a my_join_requests_changed:{user_id} event whenever someone else changes their request: deny, approve (admitted, parked on the seat limit, or already a member), admission after email verification, and team deletion. Their own redeem stays silent. Released clients see an unknown event and run a plain sync.
• Migration 069 adds an index on team_join_requests (user_id, team_id, created_at DESC) for that query. Rolling back to sha-e5af0d4 stays safe (the migrator ignores unknown versions and the old binary doesn't touch the index).

Tests: full cargo test 925 passed, cargo clippy --all-targets -- -D warnings clean. New tests cover the coded 404 (and approve staying uncoded), team_id in every response, the request list (one row per team, 30-day window, member teams excluded, caller's rows only) and who gets notified when.

Deploy before the client PR that consumes these routes merges.