Add explicit TMB device enrollment to tng auth agent tmb.
- persist an owner-only device credential for each named TMB instance
- enroll with a one-time credential and generated device proof key
- report enrollment status without exposing credential material
- revoke an enrolled device and remove its local configuration
- expose the new commands and structured output through CLI capabilities
This establishes device identity only; OAuth account login is added by the next pull request.