feat(config): keep a disabled ACME or EST block's settings so the Fleet Manager can switch it back on #300

Summary

After #286, a node stores nothing for an ACME or EST block that is switched off: internal/config/protocols.go renders a disabled protocol as an empty {Enabled: false} block. The Fleet Manager switches a protocol by reading the node's config, flipping enabled and applying it back, so switching a protocol on from the Fleet Manager always fails. It reads back an empty block, and the node rejects it for a missing base_url and profile. In practice the Fleet Manager can only switch protocols off. The docs describe this accurately today, but it's a gap in the switch-on path.

Keep a disabled block's settings: store and return base_url, profile and the other non-secret fields when enabled is false, so the same block can be switched back on without re-entering them. Write-only secrets keep their current rule, where a blank value on apply keeps the stored secret. No API contract change is needed; the fields already exist.

Acceptance criteria

• A config with acme.enabled: false plus base_url and profile is stored and returned by GetConfig with those fields intact. The same holds for EST.
• Switching on from a read-back config (flip enabled only) is accepted, and the protocol comes up after the reboot.
• Tests come first: the disabled block round-trips; switch-on from the read-back is accepted; secrets stay write-only; the Root still refuses to enable any enrolment protocol.
• The protocol-switch docs drop the "the Fleet Manager can only switch off" limitation.

Notes

Found while landing #286. The Fleet Manager side (SetNodeProtocol) needs no change once the node returns the settings. It blocks the v0.1.0 validation matrix row for switching a protocol from the Fleet Manager.