NICo CLI 2.1 follow-up REST parity

[kfelternv]

Goal

Track the v2.1 follow-up work to close the remaining REST API, OpenAPI, nicocli, and documentation parity gaps found during the admin-cli/site-setup workflow audit.

Split from #1927, which now tracks the original v2.0 admin REST work.

Scope

• Add REST API and nicocli support for expected-machine host_lifecycle_profile.disable_lockdown (Add REST API support for expected-machine host_lifecycle_profile (disable_lockdown) #2799).
• Add REST API and nicocli support for measurables / trust approve rules (Add REST API support for measurables / trust approve rules (admin-cli measurables parity) #2801).
• Add REST API and nicocli support for site-explorer mass clear-error and re-explore (Add REST API support for site-explorer mass clear-error and re-explore #2802).
• Add REST API and nicocli support for site-default UEFI credentials (Add REST API support for site-default UEFI credentials (parity with BMC credential endpoint) #2803).
• Document the REST break-fix workflow (Docs: document the REST break-fix workflow (health alert on delete, allowUnhealthyMachine, machine label updates) #2804).
• Make targeted Instance creation first-class for service-account mode (Make targeted Instance creation (service-account mode, optional instance type & compute allocation) a first-class REST/nicocli flow #2805).
• Document admin-cli site-setup commands and the REST/nicocli parity plan (Docs: document admin-cli site-setup commands and plan REST/nicocli parity #2808).

Out of scope

• Original v2.0 admin operation parity work tracked by REST API (+nicocli) should support all internal operations #1927: Add REST API support for state-changing admin ops: power, bmc-reset, dpu-reprovision, health-override #2218 and Add REST API endpoint for site-wide BMC credential setup #2219.