Let key-less PCs ask to enroll, and let an admin retry a trust-blocked PC

Found in the Windows VM re-test.

- A PC installed without the shared key got 401 from POST
  /api/endpoints/enroll while the shared key was allowed, so no request was
  recorded and no admin could approve it. Enroll now never refuses: a valid
  shared key only decides auto-issue on a clean match; no key or an invalid
  key creates or updates the one pending request for that hostname and
  serial. An approved request still issues only to its own nonce.
- A PC blocked with "server certificate not trusted by this PC" could never be
  queued again after trust was fixed, because the blocker comes from its last
  failed upgrade. Naming the PC in a wave now queues it when trust is its only
  blocker, and the response lists it under "retried"; "next n" still skips
  it. The Migration table lets such a PC be selected.
- counts.pending on GET /enrollment counts pending requests, including ones
  for unknown hostnames; counts.pendingcomputers keeps the per-computer figure.

plugins/endpoints/AGENT-CONTRACT.md

@@ -599,10 +599,14 @@ credential plus its first 12 characters (`credentialprefix`) for display.
 
 ### 9.2 Enroll
 
-`POST {baseurl}/api/endpoints/enroll`, authenticated with `X-API-Key` while
-`plugin.endpoints.sharedkeyallowed` is true. With the shared key switched off
-the route takes no auth, but then only returns a credential for a request an
-admin has approved.
+`POST {baseurl}/api/endpoints/enroll`. The route never refuses a call for its
+authentication: a PC installed without the shared key still records a pending
+request an admin can approve. `X-API-Key` only decides auto-issue: a valid
+shared key while `plugin.endpoints.sharedkeyallowed` is true. No key, an invalid
+key (logged by the server, never a 401 here) or the shared key switched off all
+mean the call is unauthenticated, and it then only returns a credential for a
+request an admin has approved for this hostname, serial and nonce. There is one
+request row per hostname and serial (case-insensitive); repeated calls update it.
 
 ```jsonc
 {
@@ -711,7 +715,12 @@ from the request body.
 
 Read needs `endpoints.fleet`; writes need the admin role and are audited.
 
-- `GET /api/endpoints/enrollment` (`page`, `perpage` <= 100, `state`, `search`)
+- `GET /api/endpoints/enrollment` (`page`, `perpage` <= 100, `state`, `search`).
+  `counts.enrolled` and `counts.notenrolled` count computers by `state`
+  (`notenrolled` includes `revoked`); `counts.pendingcomputers` counts computers
+  in state `pending`; `counts.pending` is the number of pending enroll requests,
+  including requests that match no computer (unknown hostname) and requests from
+  PCs blocked from re-enrolling, so it equals the pending entries in `requests`.
 - `POST /api/endpoints/enrollment/requests/<id>/approve` `{"assetid": n}`
 - `POST /api/endpoints/enrollment/requests/<id>/reject`
 - `POST /api/endpoints/enrollment/assets/<assetid>/revoke` (un-enroll). Optional
@@ -726,7 +735,10 @@ Read needs `endpoints.fleet`; writes need the admin role and are audited.
   record; a PC that was not blocked returns success unchanged.
 - `PUT /api/endpoints/enrollment/settings` `{"sharedkeyallowed": bool, "autoenroll": bool}`
 - `GET /api/endpoints/enrollment/migration` (`page`, `perpage` <= 100, `state`, `search`)
-- `POST /api/endpoints/enrollment/migration/wave` `{"assetids": [...]}` or `{"next": n}` (n <= 100)
+- `POST /api/endpoints/enrollment/migration/wave` `{"assetids": [...]}` or `{"next": n}` (n <= 100).
+  Returns `{"waveid", "queued": [...], "skipped": [{"assetid", "reason"}], "retried": [...]}`.
+  `retried` lists queued PCs whose only blocker was
+  `server certificate not trusted by this PC` (see below).
 - `GET /api/endpoints` rows carry `credentialstate` (`enrolled`,
   `reenrollblocked`, `pending`, `notreporting`, `sharedkey`) and accept a
   `credentialstate` filter. `GET /api/endpoints/<assetid>` carries a
@@ -737,5 +749,9 @@ Read needs `endpoints.fleet`; writes need the admin role and are audited.
   `presentedsha1thumbprint` and `matchesfile`, or `{"configured": false}`.
 - Migration blockers include `server certificate not trusted by this PC`: the
   PC's last upgrade download failed on the certificate chain (the server only
-  knows from the failure the PC reported). Trust the certificate
-  (`Install-ShopDBServerCertificate.ps1`) and queue it again.
+  knows from the failure the PC reported). It stays shown until a later upgrade
+  succeeds, so it is retryable: trust the certificate
+  (`Install-ShopDBServerCertificate.ps1`) and queue the PC again by its id in
+  `{"assetids": [...]}`. An explicit id is queued when this is the PC's only
+  blocker and is reported in `retried`; `{"next": n}` never picks such a PC, and
+  a PC with any other blocker as well is still skipped.