Add API key host enrollment endpoint

[ZacharyZcR]

Summary

• add POST /host/enroll for scriptable host enrollment with existing tmx_ API keys
• scope enrolled hosts to the user assigned to the API key and reuse the existing encrypted host creation path
• provide safe SSH defaults for minimal payloads and explicit API_KEY_REQUIRED / DATA_LOCKED responses
• document the endpoint in OpenAPI and cover its authentication and defaulting behavior

Example

curl -X POST https://termix.example/host/enroll -H "Authorization: Bearer tmx_..." -H "Content-Type: application/json" --data-binary @host.json

{"ip":"server.example","name":"server-01","tags":["auto-enrolled"]}

The API key user must have an active unlocked session because host secrets remain protected by the existing per-user encryption boundary.

Validation

• npm test -- src/backend/database/routes/host-enrollment-auth.test.ts
• npm run type-check
• npm run lint
• npm run build
• targeted ESLint and Prettier checks

Fixes Termix-SSH/Support#951

Issue: Termix-SSH/Support#951