Enrollment approval

Status: partial

Server-side enrollment is live; the admin approve-queue UI is on the way.

In a multi-user tenant, new nodes joining the mesh can require approval by a SecurityAdmin or EnrollmentApprover, who verifies the request before the node is admitted. Every node is bound to an owner, so you always know whose device it is.

Live: enrolment itself (join links / QR, owner-bound). Coming: the approval queue and per-tier ceremonies.