Pair hosts when they start instead of in the installer

The installer only writes the controller URL and host name. Running the
host requests to join the cluster if it has not been approved yet, or if
the controller no longer accepts its token, and waits until an admin
approves it. Once approved it saves its id and token and starts as
normal. A rejected host exits with code 8.

clusteriohost run --user-token approves the host right away with the
token of a user allowed to approve hosts. The token is not saved.

This moves the pairing client into the host package, where it uses the
same certificate setup as the host's connection to the controller, and
removes --no-pair and the rerun handling from the installer.

packages/controller/src/HostPairingManager.ts

@@ -258,7 +258,7 @@ export default class HostPairingManager {
 	cancel(secret: string) {
 		const request = this._bySecret.get(secret);
 		if (request && request.state === "pending") {
-			logger.verbose(`Host pairing request ${request.details.code} cancelled by the installer`);
+			logger.verbose(`Host pairing request ${request.details.code} cancelled by the host`);
 			this._remove(request);
 		}
 	}

packages/controller/src/WsServer.ts

@@ -265,7 +265,7 @@ ${err.stack}`
 
 			let host = this.controller.hosts.get(data.id);
 			if (!host) {
-				throw new Error("host is not registered, run the installer again in the host directory");
+				throw new Error("host is not registered, start the host again to request to join the cluster");
 			}
 			if (!tokenPayload.iat || tokenPayload.iat < host.tokenValidAfter) {
 				throw new Error("invalid token");