Act on the wj architectural review: races, limits, pool and contract gaps

Findings F2, F4, F5, F6, F7, F8, F9, F10, F11 and F13 from
wj-architectural-review.md. F1/F1a (the non-sargable LOWER pattern) and F3
(the warranty sync holding a pooled connection) are being handled separately
and are untouched here.

- A collector check-in that raced another for the same PC lost everything:
  the unique index on the application fingerprint raised, nothing caught it,
  and the whole check-in rolled back, discarding state, events and hardware,
  answering the agent with form copy meant for a person. The insert now runs
  in a savepoint, reconciles what the other transaction already wrote, one row
  per savepoint so a second collision skips a row rather than the batch, and
  the check-in commits with a warning. This is the shape the delete side of
  the same function already had.
- Enrollment is deliberately unauthenticated, so it now carries a per-address
  rate limit and a cap on pending requests, and the cap is a setting an admin
  can see and change. A flood can no longer bury the approval queue or grow
  the table without bound.
- The fleet alert poll no longer formats debug strings on every request.
- BusinessUnit is on the contract surface (0.34.0), so the endpoints plugin
  stops reaching into a core table with raw SQL.
- A test walks every asset type descriptor and proves the endpoint it names
  really refuses a caller without the declared permission.
- The plugin settings routes now need a permission; they were telling anyone
  which modules a site runs and where its components live.
- The connection pool is sized explicitly with a short timeout, and the
  arithmetic against the server's connection ceiling is written next to the
  worker count instead of being left to defaults nobody chose.
- Fleet alerts carry both the correct lowercase keys and the old camelCase
  pair. Trays older than 1.7.0 match keys case-sensitively and would have gone
  quiet on every PC not yet upgraded; the old pair goes when they are.
- The dev server proxy points at localhost again, with environment variables
  for the remote-box workflow, and one developer's address is out of the
  server certificate page.

plugins/endpoints/frontend/views/ServerCertSettings.vue

@@ -164,10 +164,11 @@
             v-model="generateForm.cn"
             type="text"
             class="form-control"
-            placeholder="localhost"
+            placeholder="hostname or IP"
           />
           <p class="field-hint">
-            Hostname or IP that agents use to connect (e.g., shopdb.example.com or 192.168.100.1)
+            Hostname or IP that agents use to connect, exactly as it appears in
+            the agent's base URL.
           </p>
         </div>
 
@@ -178,10 +179,12 @@
             v-model="generateForm.san"
             type="text"
             class="form-control"
-            placeholder="DNS:localhost,IP:192.168.100.1"
+            placeholder="DNS:hostname,IP:address"
           />
           <p class="field-hint">
-            Comma-separated list: DNS:hostname or IP:address (e.g., DNS:localhost,IP:192.168.100.1,DNS:shopdb.local)
+            Comma-separated list of DNS:hostname and IP:address entries. Include
+            every name and address a bay may use to reach this server; a name
+            that is missing here fails certificate validation on the endpoint.
           </p>
         </div>
 
@@ -355,9 +358,13 @@ const liveLoading = ref(false)
 const thumbprintCopied = ref(false)
 const pinCopied = ref(false)
 
+// No baked host or address (ADR-015: no site literals in product code). One
+// site's LAN address was shipped here as the default SAN, which every other
+// site would have generated a certificate for. The operator types what this
+// server is actually reached by; the form refuses to submit empty.
 const generateForm = ref({
-  cn: 'localhost',
-  san: 'DNS:localhost,IP:192.168.100.1',
+  cn: '',
+  san: '',
   days: 365
 })