R5: relay enrolment — 'beacon gen-csr' (CSR-over-SSH)

[bodaay]

beacon milestone R5 — relay enrolment

Implements beacon's side of helm's published relay-enrolment contract
(helm/BUILD.md, "Relay enrollment contract"; DESIGN §5, decision 14 —
CSR-over-SSH, no bootstrap token). Mirrors buoy's node onboarding.

beacon gen-csr

• internal/pki.GenerateCSR generates the relay's ECDSA P-256 keypair
  on the host — the private key is written 0600 to relay.key
  and never leaves the host. Idempotent: a retried enrolment reuses the
  existing key rather than orphaning it.
• Emits a plain PKCS#10 CSR — public key only. It asserts no
  Organization and no SANs: helm is the sole authority on relay
  identity and overrides them when it signs off the Fleet CA
  (O="PharosVPN Relay", dual ServerAuth+ClientAuth EKU, public-endpoint
  DNS SAN). A relay host must not self-assert the delegation marker.
• CSR → stdout (helm captures it over SSH); diagnostics → stderr.

Command surface (helm's relay-deploy invokes these)

Command	Behaviour
beacon gen-csr [--config-dir]	generate the keypair, print a CSR
beacon run --config-dir /etc/beacon	run the relay (systemd ExecStart)
beacon version	print the version

After signing, helm pushes back relay.crt, fleet-ca.crt and
device-ca.crt — exactly the files beacon run already loads from the
config dir, alongside the gen-csr-written relay.key.

Also

• Corrects beacon/BUILD.md's stale R5 line ("bootstrap token" →
  CSR-over-SSH, decision 14) and updates the README status.

Quality

gofmt / go vet / go test -race / golangci-lint all clean; new
unit tests cover key generation, idempotency, the plain-subject
guarantee, and corrupt-key handling. Zero origin-project trace.

Next and last: R6 — static-binary packaging + deploy docs.