v0.95.0: enrollment wizards use the raw-device scan /disks/candidates (Impl-2b)

Both wizards now source candidates from the agent's Impl-2a raw-device scan
(GET /disks/candidates, proxied) instead of the Observe-based /api/disks — so a
brand-new non-PVE-storage drive is finally discoverable + enrollable end-to-end.
agentapi.ListCandidates + a passthrough proxy (no controller-side filtering; the
agent's unclaimed filter is authoritative). storage_init renders `initialize`,
storage_attach renders `attach`; the enroll flow + Impl-1 guarded mkfs unchanged.
Tests + go build/vet/test clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

controller/internal/agentapi/disks_test.go

@@ -15,6 +15,12 @@ func diskStub(t *testing.T) (*httptest.Server, string) {
 	mux.HandleFunc("GET /disks", func(w http.ResponseWriter, r *http.Request) {
 		_, _ = w.Write([]byte(`{"ok":true,"data":{"vmid":8200,"disks":[{"name":"bulk","data_bearing":true,"data_reason":"has ext4"}]}}`))
 	})
+	mux.HandleFunc("GET /disks/candidates", func(w http.ResponseWriter, r *http.Request) {
+		_, _ = w.Write([]byte(`{"ok":true,"data":{"vmid":8200,` +
+			`"initialize":[{"device":"/dev/sdd","size_bytes":64000000000,"model":"USB","fstype":"ext4","data_bearing":true,"mountable":true,"mount_source":"/dev/sdd","durable_id":"uuid:abc"},` +
+			`{"device":"/dev/sde","size_bytes":1000,"data_bearing":false,"mountable":false}],` +
+			`"attach":[{"device":"/dev/sdd","fstype":"ext4","mountable":true,"mount_source":"/dev/sdd","durable_id":"uuid:abc"}]}}`))
+	})
 	mux.HandleFunc("POST /disks/assign", func(w http.ResponseWriter, r *http.Request) {
 		_, _ = w.Write([]byte(`{"ok":true,"data":{"assigned":"/mnt/data"}}`))
 	})
@@ -71,6 +77,40 @@ func TestDisks_List(t *testing.T) {
 	}
 }
 
+func TestListCandidates(t *testing.T) {
+	s, ep := diskStub(t)
+	defer s.Close()
+	c := clientFor(t, s, ep)
+	res, err := c.ListCandidates(context.Background())
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(res.Initialize) != 2 {
+		t.Fatalf("want 2 initialize candidates, got %+v", res.Initialize)
+	}
+	if len(res.Attach) != 1 || res.Attach[0].Device != "/dev/sdd" || res.Attach[0].FSType != "ext4" {
+		t.Fatalf("attach candidate wrong: %+v", res.Attach)
+	}
+	if res.Initialize[0].DurableID != "uuid:abc" || !res.Initialize[0].DataBearing {
+		t.Fatalf("initialize[0] fields wrong: %+v", res.Initialize[0])
+	}
+}
+
+func TestListCandidates_Error(t *testing.T) {
+	// A non-2xx / malformed agent response surfaces as an error, not a silent empty list.
+	mux := http.NewServeMux()
+	mux.HandleFunc("GET /disks/candidates", func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusBadGateway)
+		_, _ = w.Write([]byte(`{"ok":false,"error":"agent unreachable"}`))
+	})
+	s := httptest.NewTLSServer(mux)
+	defer s.Close()
+	c := clientFor(t, s, strings.TrimPrefix(s.URL, "https://"))
+	if _, err := c.ListCandidates(context.Background()); err == nil {
+		t.Fatal("expected an error from a 502 candidates response")
+	}
+}
+
 func TestFormat_BlankOK(t *testing.T) {
 	s, ep := diskStub(t)
 	defer s.Close()