Redfish Phase 1b: integration layer (tokenized ISO-serve, rewire call sites, creds-at-rest, context/reconciler)

[wrkode]

Part of #4109 (Phase 1b). Owners: golang-engineer + staff-engineer. Depends on Phase 1 (Deployer iface) and the Phase 0 tokenized-serve design.

Wire the new Deployer into the rest of AuroraBoot and build the secure ISO-serve.

Scope

• Tokenized single-file ISO-serve helper (Phase 0 spec): 256-bit crypto/rand token = one deployment = one file; served via http.ServeContent (Range-capable) with no http.Dir/path-join; TTL = deploy budget + margin; revoke on terminal state/eject; its own http.Server (never DefaultServeMux; do not reuse pkg/ops/network.go ServeArtifacts). New --redfish-serve-url / --redfish-serve-addr (default derived from AuroraBootURL, override allowed; never silently bind 0.0.0.0). Opt-in --redfish-serve-tls.
• Rewire both call sites to the new Deployer: internal/cmd/redfish.go (CLI) and pkg/handlers/deploy.go runRedfishDeploy (server), plus pkg/hardware/inspector.go.
• Encrypt BMCTarget.Password at rest — AES-256-GCM with a local DEK at data/secrets/bmc-key (0600); encrypt/decrypt in the store adapter. (Folds in the wider-review plaintext-password finding.)
• Real cancellable deploy context + a run registry for cancellation; startup reconciler that marks orphaned Active deployments terminal after a restart.
• Map gofish Task → store.Deployment progress/step events (InsertMedia → SetBoot → Reset → Task %), replacing the fabricated status.
• CLI creds hygiene: add --password-file/--password-stdin/env; document the --password flag as insecure.

Security acceptance criteria (from Phase 0)

• Wrong/expired serve token → 404; ../ traversal cannot escape the single bound file; token revoked after terminal state.
• --image-url/endpoint pointing at loopback/link-local/metadata (127.0.0.1, 169.254.169.254, ::1, fe80::/10) is rejected; configured serve host allowed; resolve-and-pin IP (anti-rebind).
• BMCTarget.Password round-trips as ciphertext (DB column never holds plaintext).
• Server deploy uses a real cancellable context; startup reconciler sweeps pre-existing Active rows.
• Cross-track gate (T10): the server Redfish path is not "production-ready" until the fleet server has TLS (or a required TLS proxy) — tracked in AuroraBoot fleet-server hardening (non-Redfish review findings) #4117.