Implement KCA: web reimplementation of XCA PKI workflows

- kaya backend with OIDC sessions, API tokens, Postgres/Tortoise models
- AES-256-GCM private key storage and full certificate/CSR/CRL domain logic
- Sycamore/WASM SPA for vaults, keys, requests, certificates, CRLs and templates
- imports/exports, XCA .xdb migration, Docker Compose stack and tests

web/Trunk.toml

@@ -0,0 +1,12 @@
+# Development server for the KCA SPA. Proxies the backend prefixes to the
+# app on :8080 so requests are same-origin and the session cookie works.
+[serve]
+port = 8000
+
+[[proxy]]
+rewrite = "/api"
+backend = "http://127.0.0.1:8080/api"
+
+[[proxy]]
+rewrite = "/auth"
+backend = "http://127.0.0.1:8080/auth"