feat(ca): fleet CA tooling — intermediate live on tsys-ca, first cert issued [#697]

ca-init/issue-cert/selftest (TDD loop, shellcheck clean); design doc on
Discourse t/320. Offline RSA-4096 root (Nitrokey ceremony later), 5y
intermediate, 825d SAN leaves. First cert: tsys-wazuh.knel.net (fingerprint
on the ticket note).
Meat: https://projects.knownelement.com/issues/697#note-4033

ca/README.md

@@ -0,0 +1,36 @@
+# ca/ — PFV fleet Certificate Authority tooling [#697]
+
+> Design + runbook (canonical): https://community.turnsys.com/t/320
+> Root of trust for: LDAPS, RADIUS (#476), OPNsense, k8s, iDRAC/OME,
+> Wazuh/syslog TLS. HSM-backed root ceremony comes later (#697 Nitrokey).
+
+## Architecture (v1, software)
+
+- **Root CA**: RSA-4096, 10y, OFFLINE — lives only in `/root/ca-root/` on
+  tsys-ca (moved to Nitrokey at the #697 ceremony). Never leaves the box;
+  signs only the intermediate.
+- **Intermediate CA**: RSA-4096, 5y, on tsys-ca at `/etc/ssl/tsys-ca/` —
+  signs all leaf certs. pathlen:0.
+- **Leaves**: RSA-2048, ≤825 days, SAN-based (serverAuth + clientAuth).
+- **No CRL/OCSP in v1** (fleet-internal); revocation = re-issue + intermediate
+  pinning. CRL endpoint deferred to the GLPI/ITSM pass.
+- **Compat stance**: RSA+SHA-256 only — old Dell/iDRAC-era clients.
+
+## Files
+
+| File | Purpose |
+|------|---------|
+| `ca-init.sh` | Initialize root + intermediate dirs ON THE CA HOST (keys never leave tsys-ca) |
+| `issue-cert.sh` | Issue a leaf cert: `issue-cert.sh <common-name> "DNS:a,DNS:b,IP:x"` |
+| `selftest.sh` | Full throwaway loop in /tmp — init, issue, chain-verify (TDD gate) |
+
+## Usage (on tsys-ca, as root)
+
+```bash
+bash ca-init.sh /root/ca-root /etc/ssl/tsys-ca        # once
+bash issue-cert.sh tsys-wazuh.knel.net "DNS:tsys-wazuh.knel.net,DNS:tsys-siem.knel.net"
+```
+
+Certs/CSRs land in the intermediate dir's `certs/` + `csr/`. Private keys
+stay on tsys-ca (0600); nothing in this directory is ever committed with
+key material.