feat(ca): fleet CA tooling — intermediate live on tsys-ca, first cert issued [#697]

ca-init/issue-cert/selftest (TDD loop, shellcheck clean); design doc on
Discourse t/320. Offline RSA-4096 root (Nitrokey ceremony later), 5y
intermediate, 825d SAN leaves. First cert: tsys-wazuh.knel.net (fingerprint
on the ticket note).
Meat: https://projects.knownelement.com/issues/697#note-4033

ca/issue-cert.sh

@@ -0,0 +1,36 @@
+#!/bin/bash
+#
+# issue-cert.sh — issue a leaf certificate from the fleet intermediate [#697]
+# Usage: issue-cert.sh <common-name> "SAN list"   e.g.
+#   issue-cert.sh tsys-wazuh.knel.net "DNS:tsys-wazuh.knel.net,DNS:tsys-siem.knel.net"
+# Requires: intermediate initialized at /etc/ssl/tsys-ca (ca-init.sh).
+# Output: <certs>/<cn>.crt (leaf+chain) + <certs>/<cn>.key (0600) on this host.
+#
+set -euo pipefail
+
+CN="${1:?usage: issue-cert.sh <common-name> \"SAN list\"}"
+SAN="${2:?usage: issue-cert.sh <common-name> \"SAN list\"}"
+INT_DIR="${INT_DIR:-/etc/ssl/tsys-ca}"
+INT_KEY="$INT_DIR/intermediate.key"
+INT_CRT="$INT_DIR/intermediate.crt"
+CHAIN="$INT_DIR/ca-chain.crt"
+
+[ -s "$INT_CRT" ] || { echo "intermediate missing at $INT_CRT — run ca-init.sh first" >&2; exit 1; }
+[ -s "$INT_KEY" ] || { echo "intermediate key missing" >&2; exit 1; }
+
+KEY="$INT_DIR/certs/$CN.key"
+CSR="$INT_DIR/csr/$CN.csr"
+CRT="$INT_DIR/certs/$CN.crt"
+[ -e "$CRT" ] && { echo "cert already exists: $CRT (revoke/rename first)" >&2; exit 1; }
+
+openssl genrsa -out "$KEY" 2048 2>/dev/null
+chmod 600 "$KEY"
+openssl req -new -key "$KEY" -out "$CSR" -sha256 \
+  -subj "/C=US/ST=Texas/O=Known Element Enterprises/OU=TechOps/CN=$CN"
+openssl x509 -req -in "$CSR" -CA "$INT_CRT" -CAkey "$INT_KEY" \
+  -CAcreateserial -days 825 -sha256 -out "$CRT" \
+  -extfile <(printf 'basicConstraints=CA:FALSE\nkeyUsage=digitalSignature,keyEncipherment\nextendedKeyUsage=serverAuth,clientAuth\nsubjectAltName=%s\nauthorityKeyIdentifier=keyid,issuer\n' "$SAN")
+
+cat "$CRT" "$CHAIN" > "$INT_DIR/certs/$CN.fullchain"
+openssl verify -CAfile "$CHAIN" "$CRT"
+echo "issued: $CRT (+ .key, .csr, .fullchain)"