fix(P07): remove all password/token paths (REQ-146, R-021, C-34) -- BREAKING

---ci---
project: orca
phase: 7
milestone: v0.12
status: execute
---/ci---

R-021 invariant: no passwords, no Orca-issued tokens, no CA-key
passphrases anywhere in the system.

Removed:
- proxmox/bootstrap.go: ssh.Password auth -> ssh.PublicKeys (key-based).
  --password/ removed from node join; replaced
  with --ssh-key (default: orca SSH key). Pre-staged key required.
- stepca/stepca.go: --password-file /dev/stdin removed from Init and
  issueCert. Provisioner changed to 'orca-oidc' (OIDC provisioner).
- identity/spiffe.go: --password-file removed from MintSVID. Provisioner
  changed to 'orca-oidc'.

Tests: all proxmox, stepca, identity, cli tests updated + pass. 3 new
password-rejection regression tests. Fake SSH server gains
PublicKeyCallback. go vet clean. Full build green.

internal/identity/spiffe_test.go

@@ -172,7 +172,7 @@ func TestMintSVID_Success(t *testing.T) {
 	containsCall(t, mx, "step ca certificate")
 	containsCall(t, mx, "--san 'spiffe://orca.local/ns/_defaults/sa/web/abc123'")
 	containsCall(t, mx, "--not-after '24h'")
-	containsCall(t, mx, "--provisioner 'orca-admin'")
+	containsCall(t, mx, "--provisioner 'orca-oidc'")
 }
 
 func TestMintSVID_StepFails(t *testing.T) {