feat(enterprise): issue the console CA and name the account it authorises

[traviswu-bigstack]

What type of PR is this?

/kind feature

What this PR does / why we need it

A chart-deployed Advisor logged console: disabled (no -console-account) and no console session could open. The chart gained the two values it needs in bigstack-oss/cube-ai-advisor#223; this supplies them.

• The CA is generated once and passed back on every upgrade, exactly as the enrollment CA already is.
• The account defaults to advisor, which CubeCOS already provisions for exactly this. An empty account leaves the console off, which is what every install did before.
• The install prints the CA and the command that installs it on a node.

Which issue(s) this PR fixes

The driver half of bigstack-oss/cube-ai-advisor#222.

Special notes for your reviewer

Why carrying the CA matters more than symmetry with the enrollment CA. advisor-api generates a console CA at startup when the chart passes none. A CubeCOS node pins that CA in sshd at /etc/ssh/console-ca/cube-advisor.pub and keeps it across firmware upgrades (CONFIG_MIGRATE(advisor, ADVISOR_CONSOLE_CA)), so a CA regenerated on the next pod restart stops every already-enrolled node from accepting console certificates — silently, because sshd simply stops accepting them and nothing on the Advisor notices. An unreadable existing key is refused rather than replaced.

Nothing pushes the CA to a node, by design: the Advisor mints certificates and the node decides whether to accept them. So the install ends by printing the CA and the hex_cli -c advisor -c console_trust line, rather than leaving an operator to discover that the console silently authenticates nobody. The node-side command is in the cubecos PR (#1482).

Ordering for a working console: this PR + cube-ai-advisor#223 + cubecos#1482. Any one alone leaves the console non-functional, and #223 must land before an install here can pass console.account to a chart that understands it.

Additional documentation

install-advisor.sh <framework> <lb-ip> <version> [base-url] [console-pool] [console-account]
  console-account — defaults to "advisor"; empty disables the console

🤖 Generated with Claude Code

https://claude.ai/code/session_01PZ5umjjCedZwWtbAbiMjfj