[nightshift] api-contract-verify: fix GUI API contract issues

[nightshift-micr]

Automated by Nightshift v3 (GLM 5.1).

Task: api-contract-verify
Category: pr
Changes: Fix GUI API contract issues in /api/enroll endpoint

Findings & Fixes

1. /api/enroll response includes null for expiresAt on session/permanent leases (Fixed)

   • The response used map[string]any{"expiresAt": rec.ExpiresAt} which serializes as "expiresAt": null for nil pointers, even though LeaseRecord uses omitempty.
   • Fix: Only include expiresAt in the response when it's non-nil.

2. Missing validation for timed mode with zero days (Fixed)

   • The GUI /api/enroll endpoint accepted {"mode":"timed","days":0} without error, deferring to ParseDurationDays which rejects it. However, the GUI should validate this early with a clear error message.
   • Fix: Added early validation before calling EnrollFn.
   • Added test case for the new validation.

3. presetSummary omits StableVersionOverride (Documented, not fixed)

   • The /api/presets response doesn't include stableVersionOverride. This is a minor contract gap — the frontend can't display whether a preset pins to a specific version. Not fixed as it requires frontend changes.

4. enrollRequest doesn't map NonInteractive (Documented, not fixed)

   • The GUI always runs in non-interactive mode by design. NonInteractive is not part of the request schema. This is correct behavior, documented for completeness.

Merge if useful, close if not.

[Microck]

Superseded by #43, which merged the remaining actionable API-contract and GUI validation fixes.