Implement KCA: web reimplementation of XCA PKI workflows

- kaya backend with OIDC sessions, API tokens, Postgres/Tortoise models
- AES-256-GCM private key storage and full certificate/CSR/CRL domain logic
- Sycamore/WASM SPA for vaults, keys, requests, certificates, CRLs and templates
- imports/exports, XCA .xdb migration, Docker Compose stack and tests

server/dev/mockoauth/Dockerfile

@@ -0,0 +1,6 @@
+FROM ghcr.io/navikt/mock-oauth2-server:5.0.2
+# The config is COPYed into the image rather than bind-mounted so the
+# stack also works against containerized/rootless Docker daemons, where
+# bind mounts of the build context are not always visible.
+COPY config.json /config.json
+ENV JSON_CONFIG_PATH=/config.json

server/dev/mockoauth/config.json

@@ -0,0 +1,74 @@
+{
+  "interactiveLogin": true,
+  "tokenCallbacks": [
+    {
+      "issuerId": "kca",
+      "tokenExpiry": 3600,
+      "requestMappings": [
+        {
+          "requestParam": "subject",
+          "match": "alice",
+          "claims": {
+            "sub": "alice",
+            "name": "Alice Anderson",
+            "given_name": "Alice",
+            "family_name": "Anderson",
+            "middle_name": "B.",
+            "nickname": "ali",
+            "preferred_username": "alice",
+            "profile": "https://example.com/alice",
+            "picture": "https://i.pravatar.cc/128?u=alice",
+            "website": "https://alice.example.com",
+            "gender": "female",
+            "birthdate": "1990-04-12",
+            "zoneinfo": "Europe/Oslo",
+            "locale": "en-US",
+            "updated_at": 1735689600
+          }
+        },
+        {
+          "requestParam": "subject",
+          "match": "bob",
+          "claims": {
+            "sub": "bob",
+            "name": "Bob Brown",
+            "given_name": "Bob",
+            "family_name": "Brown",
+            "preferred_username": "bob",
+            "picture": "https://i.pravatar.cc/128?u=bob",
+            "zoneinfo": "Europe/Oslo",
+            "locale": "nb-NO",
+            "updated_at": 1735689600
+          }
+        },
+        {
+          "requestParam": "subject",
+          "match": "carol",
+          "claims": {
+            "sub": "carol",
+            "name": "Carol",
+            "preferred_username": "carol",
+            "locale": "en-GB"
+          }
+        },
+        {
+          "requestParam": "subject",
+          "match": "dave",
+          "claims": {
+            "sub": "dave",
+            "name": "Dave",
+            "preferred_username": "dave"
+          }
+        },
+        {
+          "requestParam": "subject",
+          "match": ".*",
+          "claims": {
+            "sub": "${subject}",
+            "preferred_username": "${subject}"
+          }
+        }
+      ]
+    }
+  ]
+}