feat(golems): add reusable join-code enrollment for bot onboarding

[alexk-dev]

Summary

This PR establishes the first Hive-side slice of the bot integration contract.

It changes enrollment from a one-time bootstrap secret into a reusable, revocable, TTL-bound join token, returns a copy-ready join code for golemcore-bot, and documents the cross-repo contract that the bot implementation will follow.

What Changed

Reusable enrollment tokens

• enrollment tokens can now be used more than once until they expire or are revoked
• Hive tracks registrationCount, lastUsedAt, and lastRegisteredGolemId instead of treating the token as single-use
• legacy token records remain readable through schema normalization and field aliases during deserialization

Copy-ready join codes for bot onboarding

• POST /api/v1/enrollment-tokens now returns both the raw token and a ready-made join code in the format <TOKEN>:<URL>
• the join code uses hive.fleet.public-base-url when configured, with a safe request-derived fallback otherwise
• the operator flow now matches the intended bot UX: copy the join code once, paste it into the bot, and let the bot register itself

UI updates for operators

• the enrollment dialog now presents the join code as the primary artifact and adds one-click copy support
• token messaging, labels, and empty states now describe reusable join tokens instead of one-time secrets
• the tokens table now shows active/revoked state, registration counts, and the most recent golem registration

Contract and config documentation

• adds docs/bot-integration-contract.md to freeze the Hive ↔ bot integration model for join codes, config authority, machine session state, and bot-facing endpoints
• updates SPEC.md to align the product spec with reusable tokens, read-only managed Hive config in the bot, and the join-code-based onboarding flow
• adds hive.fleet.public-base-url to application config examples so operators can generate externally valid join codes

Verification

• ./mvnw test
• cd ui && nvm use && npm run test
• cd ui && nvm use && npm run build

Notes

• this is intentionally the first Hive-side slice of the broader bot integration epic
• follow-up PRs can now build against a more stable enrollment and config contract instead of continuing to iterate on one-time-token semantics