feat(fleet): operator write paths (issue from CSR, revoke, config push, CSR generation)

[Bugs5382]

Summary

FM slice D — surface the node write operations through the manager + web. The engine already supports these over its node RPCs (SignCSR, IssueLeaf, RevokeCertificate, ApplyConfig); the manager is read-only today (List*/Get*/WhoAmI only) and the web issue/revoke surfaces are mock.

Scope

• manager: write RPCs proxying to nodes — issue-from-CSR, revoke, config push; plus non-node-bearing CSR generation (a person requests a cert, not tied to a fleet node).
• web: wire the mock issue/revoke/config surfaces to live; add the CSR-generation flow.
• Authorization gated by operator level (viewer read-only, operator +issue/revoke, admin +config) from the merged mTLS auth.

Depends on the enrollment slice (write-plumbing). Design via brainstorm -> spec -> plan.