feat(ca): step-ca ACME pilot — mechanics verified e2e with lego [#697]

test-root container pilot (loopback+bridge binds); HTTP-01 issuance
proven; phase design for prod ACME/k8s/SSH on t/327#2.

https://community.turnsys.com/t/327/2

docker/stepca-test/compose.yaml

@@ -0,0 +1,20 @@
+# step-ca ACME endpoint — TEST PILOT (workstation loopback + tailnet) [#697]
+# Real-root intermediate integration is a later phase (t/327 design).
+services:
+  stepca:
+    image: smallstep/step-ca:0.30.2
+    container_name: ca-stepca-test
+    extra_hosts:
+      - "ultix-streaming.knel.net:host-gateway"
+    restart: "no"
+    ports:
+      - "127.0.0.1:8443:9000"
+      - "172.17.0.1:8443:9000"
+    volumes:
+      - data:/home/step
+    environment:
+      DOCKER_STEPCA_INIT_NAME: "KNEL CA Test Pilot"
+      DOCKER_STEPCA_INIT_DNS_NAMES: "localhost,tsys-ca.knel.net"
+      DOCKER_STEPCA_INIT_PROVISIONER_NAME: "admin"
+volumes:
+  data: