Function generate_client_csr 

pub fn generate_client_csr(
    subject_hint: &str,
) -> Result<(String, Zeroizing<String>)>

Generate a fresh client keypair (ECDSA P-256, hardware-keystore-backable) and a CSR for it. The CSR subject is only a hint; the daemon issuer overrides it with the device id it assigns (so a requester cannot choose its identity, A7). The private key is returned [Zeroizing] - the caller persists it locally and the in-memory copy is wiped on drop; it never leaves the device (only the CSR is transmitted). This is the client half of the sign_csr enrollment flow.