Make control-plane the real mount authority

Split node enrollment from export sync and issue Finder-compatible DAV
credentials so the stack proves the real backend seam before any web UI
consumes it.

packages/contracts/schemas/mount-credential.schema.json

@@ -0,0 +1,21 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://betternas.local/schemas/mount-credential.schema.json",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["mode", "username", "password", "expiresAt"],
+  "properties": {
+    "mode": {
+      "const": "basic-auth"
+    },
+    "username": {
+      "type": "string"
+    },
+    "password": {
+      "type": "string"
+    },
+    "expiresAt": {
+      "type": "string"
+    }
+  }
+}