Add desktop certificate store selection for PDF signing

[Frooodle]

Motivation

• Allow users on desktop builds to sign PDFs with certificates stored in OS keystores or hardware tokens (Windows Certificate Store, macOS Keychain, PKCS#11) and to explicitly pick the intended certificate entry by alias.
• Prevent server/remote environments from attempting to access local OS keystores by restricting these flows to desktop mode.
• Provide a UI-driven list of available store certificates so users can choose from multiple entries on the device.

Description

• Backend: added a new UI-data endpoint POST /api/v1/ui-data/cert-store-entries with request model CertStoreEntriesRequest to enumerate OS-backed certificates and a loader for Windows-MY, KeychainStore, and PKCS#11 providers; added ensureDesktopMode(...) guard to restrict store access to desktop mode.
• Signing flow: extended SignPDFWithCertRequest with certAlias and pkcs11ConfigFile and updated CertSignController to support WINDOWS_STORE, MAC_KEYCHAIN, and PKCS11 certType values, including selectKeyStoreEntry(...) to validate alias, extract private key and chain, and build an in-memory keystore for signing.
• Frontend: added useCertStoreEntries hook and isDesktopMode helper, exposed desktop-only buttons in CertificateFormatSettings, and added certificate listing, refresh, PKCS#11 config upload and alias dropdown in CertificateFilesSettings; updated form builder buildCertSignFormData to include certAlias and pkcs11ConfigFile when applicable.
• Misc: PKCS#11 provider loading uses a temporary config file and checks for the SunPKCS11 provider; certificate listing returns display-friendly metadata (subject, issuer, validity) for dropdown presentation.

Testing

• Ran ./gradlew spotlessApply which completed successfully and applied formatting changes.
• Attempted ./gradlew build but the build failed during dependency resolution with Maven Central returning HTTP 403, preventing full compilation and test execution.
• Frontend UI wiring was exercised locally via code changes (hook + components) but no E2E or automated browser tests completed because the frontend was not reachable during Playwright capture (empty response).

---

Codex Task

[stirlingbot]

🌐 TOML Translation Verification Summary

🔄 Reference Branch: pr-branch

📃 File Check: en-GB/translation.toml

1. Test Status: ✅ Passed
2. Test Status: ✅ Passed
3. Test Status: ✅ Passed

---

✅ Overall Check Status: Success

Thanks @Frooodle for your help in keeping the translations up to date.