Implement KCA: web reimplementation of XCA PKI workflows

- kaya backend with OIDC sessions, API tokens, Postgres/Tortoise models
- AES-256-GCM private key storage and full certificate/CSR/CRL domain logic
- Sycamore/WASM SPA for vaults, keys, requests, certificates, CRLs and templates
- imports/exports, XCA .xdb migration, Docker Compose stack and tests

deploy/k8s/kca.yaml

@@ -0,0 +1,132 @@
+# KCA — Kubernetes deployment sketch (namespace: kca).
+#
+# Replace every REPLACE_ME. Postgres and the OIDC provider are external; Redis
+# is included because sessions are disposable. KCA_MASTER_KEY is the AES key
+# protecting private keys at rest: generate it once and never lose it.
+#
+#   kubectl apply -f deploy/k8s/kca.yaml
+#   kubectl port-forward -n kca svc/kca 8080:80
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: kca
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: kca-config
+  namespace: kca
+data:
+  REDIS_URL: redis://redis.kca.svc.cluster.local:6379/0
+  DATABASE_ENGINE: postgres
+  DATABASE_HOST: REPLACE_ME
+  DATABASE_PORT: "5432"
+  DATABASE_NAME: kca
+  DATABASE_USER: kca
+  STATIC_DIR: /app/web/dist
+  OIDC_0_PROVIDER: default
+  OIDC_0_CLIENT_ID: kca
+  OIDC_0_ISSUER: REPLACE_ME
+  OIDC_0_REDIRECT_URI: REPLACE_ME
+  OIDC_0_POST_LOGIN_REDIRECT: /
+  OIDC_0_POST_LOGOUT_REDIRECT: /
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: kca-secrets
+  namespace: kca
+type: Opaque
+stringData:
+  DATABASE_PASSWORD: REPLACE_ME
+  OIDC_0_CLIENT_SECRET: REPLACE_ME
+  # openssl rand -base64 32
+  KCA_MASTER_KEY: REPLACE_ME
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: redis
+  namespace: kca
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: kca-redis
+  template:
+    metadata:
+      labels:
+        app: kca-redis
+    spec:
+      containers:
+        - name: redis
+          image: redis:8-alpine
+          ports:
+            - containerPort: 6379
+          resources:
+            requests: {cpu: 10m, memory: 32Mi}
+            limits: {memory: 128Mi}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: redis
+  namespace: kca
+spec:
+  selector:
+    app: kca-redis
+  ports:
+    - port: 6379
+      targetPort: 6379
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: kca
+  namespace: kca
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: kca
+  template:
+    metadata:
+      labels:
+        app: kca
+    spec:
+      securityContext:
+        runAsNonRoot: true
+      containers:
+        - name: kca
+          image: gitea.woggioni.net/woggioni/kca:latest
+          ports:
+            - containerPort: 8080
+          envFrom:
+            - configMapRef:
+                name: kca-config
+            - secretRef:
+                name: kca-secrets
+          readinessProbe:
+            httpGet:
+              path: /api/health
+              port: 8080
+          livenessProbe:
+            httpGet:
+              path: /api/health
+              port: 8080
+          resources:
+            requests: {cpu: 100m, memory: 128Mi}
+            limits: {memory: 512Mi}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: kca
+  namespace: kca
+spec:
+  selector:
+    app: kca
+  ports:
+    - port: 80
+      targetPort: 8080