[client] Let a logged-out profile deserialize again (review item 2)

ConfigFromJSON refused a document with no WireGuard or SSH key. A config
legitimately has none between a logout and the next login: mobile
LogoutProfile clears both in place and writes the profile back, so the peer
re-registers on the next login instead of returning as itself.

So the refusal broke the mobile flows it was meant to protect. On iOS and
tvOS the stored JSON of a logged-out profile stopped loading through
Client.SetConfigFromJSON and Auth.SetConfigFromJSON, and copyConfig — which
round-trips a Config through JSON to take an in-memory copy before applying
the MDM overlay — failed on the same document. Where the old code silently
minted a key, this returned an error, which is worse for logout and profile
switching alike: neither is asking to connect.

The deserializer now stays out of the identity question in both directions:
it does not generate one (a read cannot hand back keys nothing will write
down) and does not refuse one that is absent. Whoever goes on to connect is
where an absent identity has to be answered — and it already is, by the
login path that provisions and persists.

ErrConfigWithoutIdentity goes with it; nothing else used it.

client/internal/profilemanager/config_json_test.go

@@ -7,16 +7,16 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
-// The serialized form is how the tvOS SDK stores a profile, and its callers
-// connect with whatever comes back. A document with no identity used to be
-// completed by apply() minting keys, which meant connecting as a peer nothing
-// could persist; it is now refused, since the only honest answer to "restore
-// this config" for a config that was never logged in is to say so.
-func TestConfigFromJSONRefusesADocumentWithoutAnIdentity(t *testing.T) {
+// The serialized form is how the tvOS SDK stores a profile and how the iOS SDK
+// copies one in memory, so it must round-trip whatever a profile legitimately
+// holds — including no identity at all, which is the state mobile logout leaves
+// behind when it clears both keys in place. Refusing that document here broke
+// logout, profile switching and the login that follows them.
+func TestConfigFromJSONRoundTripsALoggedOutProfile(t *testing.T) {
 	path := filepath.Join(t.TempDir(), "exported.json")
 	stored, err := UpdateOrCreateConfig(ConfigInput{ConfigPath: path, ManagementURL: DefaultManagementURL})
 	require.NoError(t, err)
-	require.NotEmpty(t, stored.PrivateKey, "a provisioned config is the fixture this test needs")
+	require.NotEmpty(t, stored.PrivateKey, "a provisioned config is the fixture this test starts from")
 	require.NotEmpty(t, stored.SSHKey)
 
 	exported, err := ConfigToJSON(stored)
@@ -27,23 +27,18 @@ func TestConfigFromJSONRefusesADocumentWithoutAnIdentity(t *testing.T) {
 	require.Equal(t, stored.PrivateKey, restored.PrivateKey, "the restored peer is not the stored one")
 	require.Equal(t, stored.SSHKey, restored.SSHKey)
 
-	for _, missing := range []struct {
-		name  string
-		strip func(*Config)
-	}{
-		{"no WireGuard key", func(c *Config) { c.PrivateKey = "" }},
-		{"no SSH key", func(c *Config) { c.SSHKey = "" }},
-		{"no keys at all", func(c *Config) { c.PrivateKey = ""; c.SSHKey = "" }},
-	} {
-		t.Run(missing.name, func(t *testing.T) {
-			incomplete := stored.clone()
-			missing.strip(incomplete)
+	// What mobile logout leaves on disk.
+	loggedOut := stored.clone()
+	loggedOut.PrivateKey = ""
+	loggedOut.SSHKey = ""
 
-			document, err := ConfigToJSON(incomplete)
-			require.NoError(t, err)
+	document, err := ConfigToJSON(loggedOut)
+	require.NoError(t, err)
 
-			_, err = ConfigFromJSON(document)
-			require.ErrorIs(t, err, ErrConfigWithoutIdentity)
-		})
-	}
+	reloaded, err := ConfigFromJSON(document)
+	require.NoError(t, err, "a logged-out profile must still load")
+	require.Empty(t, reloaded.PrivateKey, "loading must not mint a key nothing will write down")
+	require.Empty(t, reloaded.SSHKey)
+	require.Equal(t, stored.ManagementURL.String(), reloaded.ManagementURL.String(),
+		"the rest of the profile survives the logout")
 }