Roadmap: MDM-friendly managed config for enterprise rollouts

[jmcte]

Context

APW today reads operator config from ~/.apw/config.json (per-user, mode 0600). Enterprise rollouts via MDM (Jamf, Kandji, Mosyle, Intune for Mac) typically push managed configuration via defaults domains or configuration profiles, not by writing to ~/.

There is no documented way for an MDM admin to:

• Pre-populate supportedDomains for a fleet.
• Pin a fallbackProvider and absolute path organization-wide.
• Disable the APW_DEMO path on managed hosts.

Proposed Fix

• Read managed defaults from dev.omt.apw (or equivalent bundle id) preference domain, layered under user config (managed > user > built-in defaults).
• Document the supported MDM keys and a sample configuration profile in a new docs/ENTERPRISE.md.
• Have apw doctor report whether managed config is in effect and which keys it overrides.

Acceptance criteria

• APW reads managed preferences via CFPreferences (or equivalent) before falling back to ~/.apw/config.json.
• apw doctor --json indicates managed-vs-user config provenance per setting.
• Sample .mobileconfig published in docs/ENTERPRISE.md.
• Tests cover the managed-overrides-user precedence rule.