feat(operators): credential requests, recording and denylist revoke

[Bugs5382]

What and why

The manager never signs an operator credential, so the old issue path is replaced by request, sign at the external CA, record, and deny. This serves the RPCs the contract already had as stubs.

Closes #147

• Requests: CreateOperatorCredentialRequest (admin) checks the CSR with CheckCSR (subject exactly CN=<email>, P-384 or RSA 3072+, the request's email), stores it pending for 30 days, and returns the CSR PEM, the op_<level> OpenSSL section built from authz.MarshalLevelExtension, and the openssl ca command. ListOperatorCredentialRequests (operator, optional state filter) and CancelOperatorCredentialRequest (admin) are served. A pending request past its expiry reads as expired; the CSR is dropped on completion, cancellation or expiry.
• Record: RecordOperatorCredential (admin) runs CheckOperatorCert. With request_id the level, CN and key must match the pending request, which is completed in the same transaction as the insert (kind requested); without it an out-of-band certificate is imported (kind recorded). It must be signed by the active operator CA (NOT_ACTIVE_ANCHOR for the retiring one) and not already recorded (DUPLICATE). A row only observed in use is upgraded in place.
• Revoke: RevokeOperatorCredential already wrote the denylist with issuer and note. It now refuses a serial that isn't hex, a reason that isn't an RFC 5280 CRL reason (0-10 except 7) and an issuer that isn't a SHA-256 fingerprint, instead of writing them. The audit summary says the credential is not revoked at the CA.
• List: ListOperatorCredentials also returns first_seen_at and last_seen_at.
• Observed credentials: with Postgres, the API path's peer authorizer records each certificate it accepts as an observed row. An LRU keeps a certificate from being written more than hourly, and a bounded queue drops a sighting when full without blocking the request; a dropped or failed sighting is retried on the next request.
• Everything is audited (operator-credential-requested, operator-credential-request-cancelled, operator-credential-recorded, operator-revoked). The new RPCs stay excluded from MCP, as the catalog already marked them.
• The in-memory store refuses requests and recording with 1603 DATABASE_REQUIRED.

Docs: docs/operator-credentials.md is new; docs/operator-pki.md (the node-hosted operator CA) is removed and its level extension table moved to the new page; links in the README, operator-ca.md and deploying-standalone.md are updated. Docs site companion: CryptOS-PKI/docs#73.

No new dependencies.

Merge order: independent of #150, #151 and #149 (trial merges with each are clean). Merge together with the docs companion.

Verification

• Lint clean
• Tests pass
• Build succeeds
• Documentation updated (if behavior or API changed)

How this was verified

task ci (gofmt, vet, golangci-lint, go test ./... with a fresh test cache) passes with MANAGER_TEST_DATABASE_URL pointing at a throwaway Postgres 18, so the store integration tests ran. task license passes. 36 new tests, each seen failing first: the Postgres store suite, the handler tests (admin gating, CSR and name refusals, request matching, 1611 states, active-anchor and duplicate refusals, the next request refused after a denial), the recorder tests (one write per certificate, hourly refresh, non-blocking overflow, retry after a failed write) and the wiring tests.

An OpenSSL 3 run of the documented flow (a P-384 CSR on the holder side, openssl ca with the returned op_operator section, openssl pkcs12 -export, openssl ca -revoke and -gencrl) produced a certificate with the level extension non-critical, and CheckCSR plus CheckOperatorCert with the CSR accepted it at level operator.

[Bugs5382]

Merging for the v0.1.0 test run: CI green and mergeable at merge time.