Self-hosted Kura cache nodes with per-account enrollment

Customers can now run Kura cache nodes in their own infrastructure for locality and data residency and bridge them into their shared Tuist-managed cache mesh. Account owners generate a per-account client credential from the Cache page, point a node at it, and the control plane handles authentication and per-account mesh CA enrollment, so the node joins the same mutually-authenticated mesh as their managed pods. Writes made through the self-hosted node are pushed through a per-account gateway into the managed mesh, and the node warms its local cache from the managed mesh when it joins. Isolation is enforced by a per-account CA, so a node’s leaf is only trusted inside its own account’s mesh.