Install in-house apps during iOS/iPadOS setup experience

[raju249]

Related issue: Resolves #50629

Stacked on #51124 (base branch 50628-setup-experience-ipa-crud) — review only this PR's commits.

Checklist for submitter

• Changes file added for user-visible changes in changes/, orbit/changes/ or ee/fleetd-chrome/changes.
  See Changes files for more information.
• Input data is properly validated, SELECT * is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters.
• Timeouts are implemented and retries are limited to avoid infinite loops

Testing

• Added/updated automated tests
• QA'd all new/changed functionality manually

Details

Final sub-task of #33995: a selected .ipa now actually installs while an iOS/iPadOS device is held in Setup Assistant, and its result drives the device release.

• Types: SetupExperienceStatusResult.InHouseAppID as a fourth mutually exclusive item kind; pairs with nano_command_uuid like VPP (IsValid table extended).
• Enqueue: fourth UNION branch in enqueueSetupExperienceItems for flagged in-house apps (iOS/iPadOS only), mirrored in the reset-after-failure variant. Deliberately no in_house_app_labels join — labels don't apply during setup experience for any software type, and a regression test asserts an out-of-scope host still gets the item, so reintroducing the check fails CI.
• Install: the iOS/iPadOS setup driver (renamed installSetupExperienceAppsOnIosIpadOS, formerly ...VPPApps... — it force-failed any non-VPP row) enqueues in-house installs through a new fleet.AppleMDMInHouseAppInstaller interface, since the logic lives in the premium service which the worker can't import (same pattern as AppleMDMVPPInstaller). The ee implementation pre-flights $FLEET_VAR_* in the managed app configuration; an unresolvable variable records the failed install + activity and returns *fleet.PreflightInstallFailedError, so the worker fails the item with the user-facing reason without emitting a duplicate activity and the device still releases. The command UUID lands in nano_command_uuid, so the existing terminal-status update (MaybeUpdateSetupExperienceVPPStatus) and the release gate work unchanged. (Left that method's "VPP" name alone to keep interface/mock churn out of this PR — happy to rename in a follow-up if preferred.)
• SetupExperienceNextStep guard: an in-house row can never legitimately reach the poll-driven (macOS) flow; it now fails the item instead of falling through the switch silently and stalling the queue.
• Command results: a device-reported InstallApplication failure for an in-house app previously produced no activity (the error branch only knew VPP); it now falls back to GetPastActivityDataForInHouseAppInstall. Verified installs are now tagged from_setup_experience (the in-house activityFn dropped the flag). fromAutoUpdate is intentionally not plumbed: ActivityTypeInstalledSoftware has no such field and in-house apps have no auto-update flow.

Tests: end-to-end integration test (TestSetupExperienceIOSInHouseApp: ABM-enrolled iPhone with a mixed .ipa + VPP payload — both install via InstallApplication (ManifestURL vs iTunesStoreID), verify via InstalledApplicationList, gate DeviceConfigured, and the verified install is recorded with from_setup_experience: true); IsValid table cases; datastore enqueue (iPhone gets the row with in_house_app_id, iPad doesn't when only iOS is selected, label-scope-ignored canary); two worker subtests (success path asserts the command UUID gates the release job; pre-flight failure path asserts terminal failure with reason and no duplicate activity).

Remaining before un-draft: manual QA on real devices (signed .ipa pending).

Note: TestIntegrations/TestPasswordReset fails locally on main too (environmental) — unrelated.

[codecov]

Codecov Report

❌ Patch coverage is 58.73016% with 52 lines in your changes missing coverage. Please review.
✅ Project coverage is 68.61%. Comparing base (26f677e) to head (0e9f830).

Files with missing lines	Patch %	Lines
ee/server/service/software_installers.go	25.00%	16 Missing and 2 partials ⚠️
server/service/apple_mdm.go	0.00%	10 Missing ⚠️
server/worker/apple_mdm.go	65.51%	6 Missing and 4 partials ⚠️
ee/server/service/setup_experience.go	0.00%	5 Missing ⚠️
server/datastore/mysql/setup_experience.go	87.50%	2 Missing and 3 partials ⚠️
server/service/apple_mdm_cmd_results.go	66.66%	1 Missing and 1 partial ⚠️
server/service/software_installers.go	0.00%	2 Missing ⚠️

Additional details and impacted files

@@                         Coverage Diff                         @@
##           50628-setup-experience-ipa-crud   #51135      +/-   ##
===================================================================
- Coverage                            68.65%   68.61%   -0.05%     
===================================================================
  Files                                 3995     3993       -2     
  Lines                               257731   257578     -153     
  Branches                             13843    13843              
===================================================================
- Hits                                176949   176735     -214     
- Misses                               65042    65126      +84     
+ Partials                             15740    15717      -23     

Flag	Coverage Δ
backend	69.70% <58.73%> (-0.05%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.