Generate a provisioning token (owner/admin session, provider org only)

Every token lives 24 hours from creation and enrolls any number of nodes in that window; neither is a request input. The node runtime is not a token property; each node detects its own shape at enroll (baremetal becomes qemu, a cloud guest becomes runc). Expired and revoked tokens stay listed for 7 days after creation, then fall out.