Implement KCA: web reimplementation of XCA PKI workflows

- kaya backend with OIDC sessions, API tokens, Postgres/Tortoise models
- AES-256-GCM private key storage and full certificate/CSR/CRL domain logic
- Sycamore/WASM SPA for vaults, keys, requests, certificates, CRLs and templates
- imports/exports, XCA .xdb migration, Docker Compose stack and tests

server/.env.example

@@ -0,0 +1,48 @@
+# Environment configuration for KCA. Copy to .env or export the variables.
+
+# --- Database --------------------------------------------------------------
+DATABASE_ENGINE=postgres
+DATABASE_HOST=localhost
+DATABASE_PORT=5432
+DATABASE_NAME=kca
+DATABASE_USER=kca
+DATABASE_PASSWORD=password
+#DATABASE_OPTIONS=
+#DATABASE_URL=
+
+# --- OIDC ------------------------------------------------------------------
+# Indexed blocks OIDC_0_*, OIDC_1_*, ... with contiguous indices from 0.
+OIDC_0_PROVIDER=default
+OIDC_0_ISSUER=http://localhost:8180/kca
+OIDC_0_CLIENT_ID=kca
+OIDC_0_CLIENT_SECRET=dev-secret
+OIDC_0_REDIRECT_URI=http://localhost:8080/auth/default/callback
+OIDC_0_POST_LOGIN_REDIRECT=http://localhost:8080/
+OIDC_0_POST_LOGOUT_REDIRECT=http://localhost:8080/
+
+# --- Sessions --------------------------------------------------------------
+REDIS_URL=redis://localhost:6379/0
+
+# --- Private-key encryption ------------------------------------------------
+# REQUIRED in production: a random 32-byte AES-256 key, base64 or hex.
+#   openssl rand -base64 32
+# When unset, a built-in development key is used (the UI warns about it).
+#KCA_MASTER_KEY=
+
+# --- Application -----------------------------------------------------------
+APP_HOST=0.0.0.0
+APP_PORT=8080
+STATIC_DIR=web/dist
+MAX_UPLOAD_BYTES=20971520
+KEYGEN_CONCURRENCY=2
+SESSION_COOKIE_SECURE=false
+#LOGGING_CONFIG=
+
+# --- CORS (optional) -------------------------------------------------------
+#CORS_ALLOW_ORIGINS=
+#CORS_ALLOW_ORIGIN_REGEX=
+#CORS_ALLOW_METHODS=GET
+#CORS_ALLOW_HEADERS=
+#CORS_ALLOW_CREDENTIALS=false
+#CORS_EXPOSE_HEADERS=
+#CORS_MAX_AGE=600