the invite flow replaced device enrolment; it is not a gap

closes the one open item left by deleting /api/vpn. removing the vpn capability
leaves no member-grantable headscale surface and that is correct: the owner
mints an invite from the headscale app, the companion turns it into the redirect
the phone claims, and the device joins. no per-member permission on officer is
involved at any step.

recorded as decided rather than open so nobody reintroduces a member-facing
enrolment route believing something was lost. nothing was — /api/vpn/enroll was
the design the invite flow replaced, and it never had a UI.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/offscale-plugin.md

@@ -271,9 +271,17 @@ in the invite (`https://<domain>/officer-api`).
 (`EXEMPT_API_PREFIXES`) because Bitwarden clients carry a Vaultwarden bearer rather than a platform JWT.
 The exemption must be declared with a reason or the boot check refuses. Not needed today.
 
-**Open:** the `vpn` capability is the only member-grantable piece of headscale — everything else is
-`admin`. If it disappears with the route, members lose the ability to enrol their own devices. Decide
-deliberately rather than losing it in the move.
+**Not an open question — decided.** Removing `vpn` leaves no member-grantable headscale surface, and that
+is correct. The invite flow supersedes it completely:
+
+1. the Officer headscale app holds an admin API key for the Headscale server
+2. from it the owner mints an **invite** — a URL pointing at the Companion
+3. the Companion turns that into the redirect the phone app claims
+4. the device joins
+
+That path needs no per-member permission on Officer at all, and it is the one that exists and works.
+`/api/vpn/enroll` was the design it replaced, not a capability still waiting for a UI — there never was
+one. Do not reintroduce a member-facing enrolment route on the assumption something is missing.
 
 ---