[kipavy]

On a machine enrolled through its machine policy (enrollment.token in policy.json, Android/iOS managed config or the macOS profile), the enrolling team's policy now applies whichever account is active: signed out, offline accounts, accounts on other servers, accounts outside the team (#757). Needs VoltiusApp/server#130, already deployed.

• The client fetches the team's policy with the token from POST /v1/enrollment/policy and keeps the checked result in a device-scoped store (voltius-enrolled-team), so it applies at startup offline and survives account switches with no gap.
• It ranks ahead of the account's own teams. When the account is a member of the same team, the account copy is skipped so the team counts once.
• Refresh: when the machine policy loads, every 15 minutes while visible, at most once per 5 minutes per token, at once when the token changes, and when the account's copy of the team shows a newer policy revision. After an app upgrade the policy is fetched once in full so newly known keys apply.
• The cache is dropped only on ENROLLMENT_NOT_FOUND or ENROLLMENT_REVOKED. Network errors, 5xx, 429, 403 and a plain 404 keep it. The secret is never sent to a server the server allow-list rejects.
• Rotate and Revoke confirms in the Members share sheet now say what happens to enrolled devices, in all 8 locales: rotation keeps them managed, Revoke stops their team policy.

Known limits: a rotated (superseded) token can still read the team's name and policy for good; it can no longer be used to join. A local user who clears app data while blocking the server can drop the cached policy; locks that must survive that belong in the root-owned machine policy.