feat: formation join token (#141)

tests/e2e/TEST_COVERAGE.md

@@ -306,11 +306,11 @@ Tests that EC2 resources are properly isolated between tenant accounts (Alpha, B
 - Simulated network IPs (no ramdisk — start-dev.sh uses disk-backed WAL/VB in CI)
 
 ### Phase 2: Cluster Initialization
-- `spx admin init` (leader node1)
+- `spx admin init` (leader node1) — generates join token, writes to `~/node1/config/join-token`
 - CA certificate trust
-- Start node1 services
-- `spx admin join` (node2, node3)
-- Start node2 + node3 services
+- Read join token from node1 config
+- `spx admin join` with `--token` (node2, node3 — concurrent)
+- Start all 3 node services concurrently
 
 ### Phase 3: Cluster Health Verification
 - Verify NATS cluster (3 nodes)
@@ -562,7 +562,7 @@ Runs on a real 3-node libvirt cluster provisioned by OpenTofu (`scripts/tofu-clu
 4. `git fetch` + checkout test branch on all nodes (all 3 repos)
 5. `make build` on all nodes (parallel)
 6. `setup-ovn.sh` — primary gets `--management`, secondaries connect to primary's OVN central
-7. `spx admin init` on primary, `spx admin join` on secondaries (formation server handshake)
+7. `spx admin init` on primary (generates join token), read token via SSH, `spx admin join --token` on secondaries
 8. `start-dev.sh` on all nodes
 9. Wait for `/health` (awsgw=ok) on all nodes
 10. Install Spinifex CA certificate on all nodes

tests/e2e/lib/multinode-helpers.sh

@@ -796,6 +796,16 @@ init_leader_node() {
     for i in $(seq 1 60); do
         if curl -sk "https://${NODE1_IP}:${CLUSTER_PORT}/formation/health" > /dev/null 2>&1; then
             echo "  Formation server is ready (PID: $LEADER_INIT_PID)"
+
+            # Read join token written by admin init
+            JOIN_TOKEN=$(cat "$HOME/node1/config/join-token")
+            if [ -z "$JOIN_TOKEN" ]; then
+                echo "  ERROR: Join token file is empty"
+                return 1
+            fi
+            echo "  Join token loaded"
+            export JOIN_TOKEN
+
             return 0
         fi
         sleep 1
@@ -824,6 +834,7 @@ join_follower_node() {
         --cluster-bind "$node_ip" \
         --cluster-routes "${NODE1_IP}:${NATS_CLUSTER_PORT}" \
         --host "${NODE1_IP}:${CLUSTER_PORT}" \
+        --token "$JOIN_TOKEN" \
         --data-dir "$data_dir/" \
         --config-dir "$data_dir/config/" \
         --region ap-southeast-2 \