Self-hosted Kura cache nodes with per-account mesh enrollment

Customers can now run their own Kura cache nodes in their own infrastructure, authorized by Tuist’s control plane and bridged into the same mutually authenticated mesh as their managed nodes. A self-hosted node is provisioned with a per-account credential plus a URL, auto-enrolls with a per-account peer CA (no inbound connections needed, keypair generated locally), pushes writes into the managed mesh via a per-account peer gateway, and warms from that mesh at join so new nodes come up populated. The Cache page issues, masks, and revokes the tenant-scoped credential.