[SaladDay]

Web part F2a of phase 2 (one-command node add), following the backend's 2a (#144).

Changes

• Exact node matching. The Add node dialog follows the node whose enrollment_id equals its command's. This replaces matching on max_active/max_retained, which confused two valid commands with the same limits.
  • A node enrolled before Core recorded the ID reports null and never matches, and neither does a command without an ID.
  • Adopting the previous command's node after expiry also uses the ID.
• Missing node files. When /console/config.node_artifacts doesn't list the deployment's provider, the dialog says the console has no node files for it: install Core from the offline bundle, or add the release artifacts and rerun ./install.sh. It offers no Generate and creates no token.
  • An absent field (older console) blocks nothing; null or a malformed value reads as none.
• Host requirements. Nodes reach only the console and Core; the "release downloads" wording is gone. The "Not connected yet" hint gains a tip: the node service keeps retrying while Core is unavailable and stops once the node is removed.

Tests

• Unit tests: the ID match (a same-limits node from another command, null IDs, a command without an ID) and node_artifacts parsing (absent, null, malformed, missing provider).
• e2e: another command's same-limits node registering while the dialog is closed isn't adopted; a thin bundle (node_artifacts: []) shows the message with no Generate and no writes.

Results: typecheck ✓, agents-client 601, web 343, build ✓, full web e2e 28/28. packages/agents-client is unchanged; the TEMP stand-in was dropped.

docs/web (already reviewed by the backend session)

protocol-coverage.md:124 (Nodes) and :127 (Enrollment).

---

^{Need help on this PR? Tag @codesmith with what you need. Autofix is disabled.}