Vault: enrolment token and node account, signing for enrolment, a node's two logins and their rotation, own hand-out of a login

The vault serves the verbs enrolment-token, node-account, rotate-node, node-account-confirm and abandon, keeps the state
node-logins, and says rotation-begun, node-account-ready and rotation-done (ADR 0587 §3, §5, §8; ADR 0583 §1-§7 and
insights; ADR 0561 §4, §5). Only mesh-enrolment asks the first two and sign for an enrolment; a rotation needs a hand act
read back from mesh-hand-acts by its id, runs one at a time with the bus node last, and is ready only when the loaded list
holds the new login and done when it lacks the old one. A node's login is handed to that node's engine alone, sealed to
the key it stated. The key of a node that leaves the placement is deleted. Accounts kept for an enrolment or a node are
marked and never retired as unwanted.

Subtasks 774/S43 to S50 in one commit: they share enrolment.go, noderotation.go, tools.go and the manifest, and could not
be cut apart without a commit that does not build. New tests: 3 unit functions (table-style flows) and the one
integration test of S50; mesh-vault stays at 134 unit and 2 integration tests, within the module budget of 500 and 50, so
none was merged or deleted. The integration test's player gained a mesh/ask answer.

(issue 774, 774/S43, 774/S44, 774/S45, 774/S46, 774/S47, 774/S48, 774/S49, 774/S50)
Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL

modules/mesh-vault/module.json

@@ -21,7 +21,13 @@
     "account-hashed",
     "own-replaced",
     "account-issued",
-    "signed"
+    "signed",
+    "rotation-begun",
+    "node-account-ready",
+    "rotation-done"
+  ],
+  "invokes": [
+    "seat:mesh-hand-acts.hand-acts"
   ],
   "reads": [
     "node-engine.have",
@@ -37,7 +43,8 @@
       "history": 2
     },
     "signers",
-    "bound"
+    "bound",
+    "node-logins"
   ],
   "receives": {
     "secret": "${dir:grants}/mesh.json"
@@ -156,7 +163,8 @@
           "MESH_VAULT_ROOT": "${dir:root}",
           "MESH_VAULT_STORE": "${dir:store}",
           "MESH_VAULT_STATE": "${dir:state}",
-          "MESH_VAULT_SECRET_ASK_CALLERS": "node-tools"
+          "MESH_VAULT_SECRET_ASK_CALLERS": "node-tools",
+          "MESH_VAULT_ENROLMENT_CALLERS": "mesh-enrolment"
         }
       }
     ]
@@ -182,7 +190,8 @@
     "own_take_switch",
     "vault_signers",
     "vault_signed",
-    "signers_reassert"
+    "signers_reassert",
+    "node_logins"
   ],
   "claims": [
     {
@@ -199,7 +208,12 @@
         "move-asks",
         "own",
         "issue-account",
-        "sign"
+        "sign",
+        "enrolment-token",
+        "node-account",
+        "rotate-node",
+        "node-account-confirm",
+        "abandon"
       ]
     }
   ]