[kipavy]

Enrolled machines can now fetch their enrolling team's policy with the enrolment token, so the client can apply it whichever account is signed in (VoltiusApp/voltius#757).

• New unauthenticated POST /v1/enrollment/policy with {id, secret, revision?}. Returns {team: {id, name, policy, policy_revision}}, or {unchanged: true, name} when the revision matches. Served whatever the team's plan state, and not behind the team-invites switch.
• Live, expired and rotated (superseded) tokens can read; an explicitly revoked token gets 410 ENROLLMENT_REVOKED; unknown id, wrong secret or deleted team gets 404 ENROLLMENT_NOT_FOUND.
• Migration 070 adds team_enrollment_tokens.superseded_at. Rotation sets it on the old token; Revoke does not. Tokens rotated before 070 are backfilled as superseded (old revoked_at equals the new token's created_at, same transaction).
• Own per-IP limiter, 300 per minute: about 4,500 machines behind one NAT polling every 15 minutes.
• resolve, redeem and register now share one token lookup and one id/secret struct; their behaviour and wire shapes are unchanged.

Rollback to sha-d26a9d8 is safe (the column is nullable and missing migrations are ignored). Rotations made while rolled back are not marked superseded; re-run the 070 UPDATE after rolling forward if that happens.