Make control-plane the real mount authority

Split node enrollment from export sync and issue Finder-compatible DAV
credentials so the stack proves the real backend seam before any web UI
consumes it.

packages/contracts/schemas/mount-profile.schema.json

@@ -10,7 +10,7 @@
     "displayName",
     "mountUrl",
     "readonly",
-    "credentialMode"
+    "credential"
   ],
   "properties": {
     "id": {
@@ -31,8 +31,8 @@
     "readonly": {
       "type": "boolean"
     },
-    "credentialMode": {
-      "enum": ["session-token", "app-password"]
+    "credential": {
+      "$ref": "./mount-credential.schema.json"
     }
   }
 }