Default Agent Auto-Update setting for newly enrolled hosts

Every new host, whether it comes in through an auto-enrollment token or "Add host", starts with Agent Auto-Update off. That happens even when automatic agent updates are switched on globally in Settings. So every new host has to be found and switched on by hand. It's easy to miss, because a new host reports and looks healthy either way.

Request: let new hosts pick up a configurable default. Any of these would work:

• a global "Agent Auto-Update for new hosts" setting, next to the existing global switch
• a per-token default on auto-enrollment tokens, like the existing default host group
• an optional auto_update field on the auto-enrollment enroll request

Context (v2.1.3, same on main): both create paths build the host without setting auto-update, so false is stored and the column's DEFAULT true never applies. The global setting only acts as a master switch at update time; it isn't copied to new hosts. PatchMon/PatchMon#826 describes a similar gap for Docker integration on auto-enrolled hosts, so per-token defaults for integrations might fit the same request.