Implement KCA: web reimplementation of XCA PKI workflows

- kaya backend with OIDC sessions, API tokens, Postgres/Tortoise models
- AES-256-GCM private key storage and full certificate/CSR/CRL domain logic
- Sycamore/WASM SPA for vaults, keys, requests, certificates, CRLs and templates
- imports/exports, XCA .xdb migration, Docker Compose stack and tests

server/dev/mockoauth/Dockerfile

@@ -0,0 +1,6 @@
+FROM ghcr.io/navikt/mock-oauth2-server:5.0.2
+# The config is COPYed into the image rather than bind-mounted so the
+# stack also works against containerized/rootless Docker daemons, where
+# bind mounts of the build context are not always visible.
+COPY config.json /config.json
+ENV JSON_CONFIG_PATH=/config.json