Make control-plane the real mount authority

Split node enrollment from export sync and issue Finder-compatible DAV
credentials so the stack proves the real backend seam before any web UI
consumes it.

packages/contracts/schemas/mount-credential.schema.json

@@ -0,0 +1,21 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://betternas.local/schemas/mount-credential.schema.json",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["mode", "username", "password", "expiresAt"],
+  "properties": {
+    "mode": {
+      "const": "basic-auth"
+    },
+    "username": {
+      "type": "string"
+    },
+    "password": {
+      "type": "string"
+    },
+    "expiresAt": {
+      "type": "string"
+    }
+  }
+}

packages/contracts/schemas/mount-profile.schema.json

@@ -10,7 +10,7 @@
     "displayName",
     "mountUrl",
     "readonly",
-    "credentialMode"
+    "credential"
   ],
   "properties": {
     "id": {
@@ -31,8 +31,8 @@
     "readonly": {
       "type": "boolean"
     },
-    "credentialMode": {
-      "enum": ["session-token", "app-password"]
+    "credential": {
+      "$ref": "./mount-credential.schema.json"
     }
   }
 }