Three related robustness fixes for the cloud pairing flow:
1. Trusted license public keys are env-configurable (ZPAN_LICENSE_PUBLIC_KEYS)
instead of hardcoding dev keys in source — a leaked dev key is rotated via
config and never baked into production builds. Registered in all platform
factories.
2. Certificate verification surfaces a specific rejection reason
(signature/issuer/instance/expired/host), and the pairing modal distinguishes
a cert-verification failure from a genuine timeout instead of showing both as
"expired". On failure the poll handler rolls back the orphaned cloud binding.
3. After verifying + storing the certificate, the instance confirms the binding
to the cloud (zpan-cloud-sdk 2.1.0's POST /licenses/:id/confirm) so the cloud
pairing page resolves to success only once the instance actually accepted it.
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
