[Bugs5382]

What and why

After a node installs and reboots during adoption, it presents a new management certificate that nothing links to the maintenance fingerprint confirmed in step 1. The manager now pauses the adoption on the awaiting-fingerprint-confirmation phase until the operator confirms that certificate against the node's console. This adds that step to the adopt wizard.

• Show: while the stream is paused, the wizard shows the installed node's SHA-256 in colon-separated uppercase pairs, with a note to compare it with the Mgmt SHA-256 line on the node's console.
• Confirm: "Fingerprint matches the console" calls ConfirmAdoptionFingerprint with the stream's adoption_id and the presented fingerprint, and progress continues on the same stream. A refusal from the manager is shown inline.
• Cancel: "Does not match: cancel adoption" aborts the stream, so the manager stops before it trusts or records anything.
• Progress rail: both the root and the subordinate phase lists include the new phase.
• Mock mode pauses on the same phase with a canned fingerprint and refuses a mismatch, so the flow can be tried offline.
• Stubs: src/gen/fleet/ on main already carries AdoptNodeResponse.adoption_id, presented_cert_sha256 and the new RPC (refreshed to api main by feat(operators): credential requests, complete, deny and a client-side request page #145), so this PR doesn't touch it. wire-fields.test.ts pins the two fields.

Existing test changed: the "streams phase progress and shows the node established" page test now also expects the AbortSignal the wizard passes to adoptNode, because the new cancel action needs it.

Refs CryptOS-PKI/cryptos-manager#144
Refs CryptOS-PKI/cryptos-manager#135

Merge order: after CryptOS-PKI/api#133. CryptOS-PKI/cryptos-manager#150 and CryptOS-PKI/docs#71 are merged; merge this next. Until it merges, the deployed wizard sits on the new phase until the manager gives up after 15 minutes.

Docs: the docs site companion is CryptOS-PKI/docs#71 (it covers this wizard step), with the manager side in CryptOS-PKI/cryptos-manager#150. The README is unchanged (it lists adoption at a level this doesn't change).

Verification

• Lint clean
• Tests pass
• Build succeeds
• Documentation updated (if behavior or API changed)

How this was verified

• Tests written first, failing before the change: src/lib/adopt.test.ts (the mock pause until confirm, mismatch refusal, the live relay of adoptionId and presentedCertSha256, the stop signal, the confirm call and its refusal, the fingerprint compare and format helpers), src/pages/adopt.test.tsx (show and confirm, a refused confirm inline, cancel aborts the stream without confirming), src/lib/wire-fields.test.ts (failed against the old stubs).
• After a rebase onto main (e8099d6), npm run lint, npm test (85 files, 500 tests), npm run build and task license pass locally.

[Bugs5382]

Merging for the v0.1.0 test run: CI green and mergeable at merge time.