fix(P07): remove all password/token paths (REQ-146, R-021, C-34) -- BREAKING

---ci---
project: orca
phase: 7
milestone: v0.12
status: execute
---/ci---

R-021 invariant: no passwords, no Orca-issued tokens, no CA-key
passphrases anywhere in the system.

Removed:
- proxmox/bootstrap.go: ssh.Password auth -> ssh.PublicKeys (key-based).
  --password/ removed from node join; replaced
  with --ssh-key (default: orca SSH key). Pre-staged key required.
- stepca/stepca.go: --password-file /dev/stdin removed from Init and
  issueCert. Provisioner changed to 'orca-oidc' (OIDC provisioner).
- identity/spiffe.go: --password-file removed from MintSVID. Provisioner
  changed to 'orca-oidc'.

Tests: all proxmox, stepca, identity, cli tests updated + pass. 3 new
password-rejection regression tests. Fake SSH server gains
PublicKeyCallback. go vet clean. Full build green.

internal/cli/node_test.go

@@ -154,22 +154,23 @@ func TestNodeJoinProxmoxMissingHost(t *testing.T) {
 	var buf bytes.Buffer
 	rootCmd.SetOut(&buf)
 	rootCmd.SetErr(&buf)
-	rootCmd.SetArgs([]string{"node", "join", "--type", "proxmox", "--password", "x"})
+	rootCmd.SetArgs([]string{"node", "join", "--type", "proxmox", "--ssh-key", "/tmp/nonexistent-key"})
 	if err := rootCmd.Execute(); err == nil {
 		t.Fatal("expected error for proxmox without --host, got nil")
 	}
 }
 
-func TestNodeJoinProxmoxMissingPassword(t *testing.T) {
+func TestNodeJoinProxmoxMissingSSHKey(t *testing.T) {
 	_, cleanup := initTestEnv(t)
 	defer cleanup()
 	resetRootFlags(t)
 	var buf bytes.Buffer
 	rootCmd.SetOut(&buf)
 	rootCmd.SetErr(&buf)
+	// No --ssh-key and no default orca key -> error (R-021).
 	rootCmd.SetArgs([]string{"node", "join", "--type", "proxmox", "--host", "10.0.0.99"})
 	if err := rootCmd.Execute(); err == nil {
-		t.Fatal("expected error for proxmox without password, got nil")
+		t.Fatal("expected error for proxmox without ssh-key, got nil")
 	}
 }
 
@@ -473,7 +474,7 @@ func TestNodeJoinHostKeyFingerprintRequiresProxmox(t *testing.T) {
 // We can't run the full bootstrap without a real SSH server, so we
 // assert that the RunE check passes (no "requires --type proxmox"
 // error) and the failure — if any — comes from a later stage (missing
-// --host / password), not the D-044 guard.
+// --host / ssh-key), not the D-044 guard.
 func TestNodeJoinHostKeyFingerprintProxmoxAccepted(t *testing.T) {
 	_, cleanup := initTestEnv(t)
 	defer cleanup()
@@ -494,3 +495,21 @@ func TestNodeJoinHostKeyFingerprintProxmoxAccepted(t *testing.T) {
 		t.Errorf("D-044 guard wrongly rejected proxmox type: %v", err)
 	}
 }
+
+// --- REQ-146 / R-021 password removal regression test ---
+
+// TestNodeJoinProxmoxPasswordRejected verifies the --password flag is
+// no longer accepted (R-021: no passwords). The flag is removed; the
+// CLI should reject it as an unknown flag.
+func TestNodeJoinProxmoxPasswordRejected(t *testing.T) {
+	_, cleanup := initTestEnv(t)
+	defer cleanup()
+	resetRootFlags(t)
+	var buf bytes.Buffer
+	rootCmd.SetOut(&buf)
+	rootCmd.SetErr(&buf)
+	rootCmd.SetArgs([]string{"node", "join", "--type", "proxmox", "--host", "10.0.0.99", "--password", "secret"})
+	if err := rootCmd.Execute(); err == nil {
+		t.Fatal("expected error for --password (R-021: no passwords), got nil")
+	}
+}