SSH certificate admin frontend

[archbilesherman]

Summary

Adds the privileged SSH certificate administration UI:

• Deployment-wide certificate list, pagination, current-page search/status filters, and detailed metadata.
• CASL-gated navigation and pages for signer read/write privileges.
• Active-certificate revoke dialog with validated reasons, authoritative backend refetch, and explicit race/error handling.
• Signer-aware portal proxy routing and MSW fixtures.
• Signer-only Playwright CI covering permissions, lifecycle states, pagination, revocation races, and accessibility.

Verification

• pnpm verify
• 646 unit/component tests passed
• 16 signer Playwright scenarios passed
• Production build passed

Stacked on signer-backend-revoke; retarget to master after the backend PR merges.

[lahirujayathilake]

@archbilesherman, An extension should own its UI. We should use Next.js multi zones for this, so this would move into the signer as its own Next.js app at extensions/SSH-Certificate-Signer/web/ with basePath /signer, and the portal proxies /signer/* to it.

It would need a manifest at /.well-known/custos-extension.json so the portal can find it, and handle its own auth by reading the shared session cookie and calling the signer API with the user's token.