feat(web): full cryptosctl parity in the Fleet Manager web — tracking (S0–S11)

[Bugs5382]

Bring every operator operation into the Fleet Manager web so users never need the CLI. Big-bang delivery, incremental build behind the mock/live seam, one cutover.

GOLD context: the web is pillar 1 of four (web parity, CLI, ESXi ISO builder, control-plane Helm chart).

Sub-issues track each vertical slice (api → manager → web). This issue is the checklist; it is filled in as the sub-issues are created.

Slices

• — feat(store): hand-rolled Postgres persistence for the manager #25
• S0 — feat(web): issue a leaf certificate live via the manager #26
• S1 — feat(web): revoke a certificate live via the manager #27
• S2 — feat(web): finish LINK enrollment end-to-end #28
• S3 — feat(web): re-key a subordinate live via the manager #29
• S4 — feat(web): apply managed-node config live via the manager #30
• S5 — feat(web): profile management (catalog + node instances + overrides) #31
• S6 — feat(web): protocol adapter enable/disable toggle #32
• S7 — feat(web): CA key escrow export and import #33
• S8 — feat(web): operator credential management #34
• S9 — feat(web): adopt-a-new-node provisioning #35
• S10 — feat(web): remote node decommission #36
• S11 — feat(web): cut over the web to live-default #37
• X1 — test(web): full-loop E2E against a real ESXi node #38