Add open enrollment + update Windows installer

Open enrollment (OPEN_ENROLLMENT=true in .env):
- Agents can register with just --server <url>, no token needed
- Machines assigned to OPEN_ENROLLMENT_USER_EMAIL, first admin, or first user
- Falls back gracefully if env var not set
- agent.py register() now takes optional token; --server alone triggers registration

Agent CLI changes:
- --server without --enroll triggers open enrollment registration on first run
- --enroll still works for token-based or re-enrollment
- Error message updated to reflect new syntax

NSIS installer changes:
- Interactive mode: custom page prompts for server URL + optional token
- Silent mode: /SERVER= alone works with open enrollment, /ENROLL= still supported
- Cleans up config on uninstall

agent.spec: add pyperclip, base64, struct, uuid to hidden imports

docker-compose + .env: OPEN_ENROLLMENT and OPEN_ENROLLMENT_USER_EMAIL vars

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

agent/agent.spec

@@ -34,12 +34,16 @@ a = Analysis(
         'websockets.legacy.client',
         'httpx',
         'httpcore',
+        'pyperclip',
         'asyncio',
         'json',
         'logging',
         'platform',
         'subprocess',
         'signal',
+        'base64',
+        'struct',
+        'uuid',
     ],
     hookspath=[],
     runtime_hooks=[],