Arthexis API consumers that use enrollment bearer tokens (Netmesh HTTP endpoints and node-network OCPP control actions) follow one canonical lifecycle.
1) Issuance path
Tokens are minted through apps.nodes.services.enrollment.issue_enrollment_token.
Admin reissue actions call the same service, so issuance and reissue share one code path.
Preconditions:
target node record exists;
node state transitions to PENDING during issuance;
operator chooses an explicit scope (default: mesh:read).
