Implement KCA: web reimplementation of XCA PKI workflows

- kaya backend with OIDC sessions, API tokens, Postgres/Tortoise models
- AES-256-GCM private key storage and full certificate/CSR/CRL domain logic
- Sycamore/WASM SPA for vaults, keys, requests, certificates, CRLs and templates
- imports/exports, XCA .xdb migration, Docker Compose stack and tests

web/pwa/icons/icon.svg

@@ -0,0 +1,6 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 512 512">
+  <rect width="512" height="512" rx="96" fill="#0a1720"/>
+  <path d="M256 72l150 58v112c0 92-62 166-150 198-88-32-150-106-150-198V130z" fill="none" stroke="#5eead4" stroke-width="26"/>
+  <path d="M198 206h116v34H198zm0 66h116v34H198z" fill="#fbbf24"/>
+  <circle cx="256" cy="300" r="18" fill="#fbbf24"/>
+</svg>

web/pwa/manifest.webmanifest

@@ -0,0 +1,18 @@
+{
+  "name": "KCA — Key & Certificate Authority",
+  "short_name": "KCA",
+  "description": "Web PKI management: keys, CSRs, certificates, CRLs and templates.",
+  "start_url": "/",
+  "scope": "/",
+  "display": "standalone",
+  "background_color": "#0a1720",
+  "theme_color": "#0a1720",
+  "icons": [
+    {
+      "src": "/icons/icon.svg",
+      "sizes": "any",
+      "type": "image/svg+xml",
+      "purpose": "any maskable"
+    }
+  ]
+}

web/pwa/sw.js

@@ -0,0 +1,26 @@
+/* KCA app-shell service worker. It caches only the static shell, never API
+ * responses: certificate and key material must not be served stale. */
+const CACHE = "kca-shell-v1";
+const SHELL = ["/", "/manifest.webmanifest", "/icons/icon.svg"];
+
+self.addEventListener("install", (event) => {
+    event.waitUntil(caches.open(CACHE).then((cache) => cache.addAll(SHELL)).then(() => self.skipWaiting()));
+});
+
+self.addEventListener("activate", (event) => {
+    event.waitUntil(
+        caches.keys().then((keys) => Promise.all(keys.filter((key) => key !== CACHE).map((key) => caches.delete(key))))
+            .then(() => self.clients.claim())
+    );
+});
+
+self.addEventListener("fetch", (event) => {
+    const request = event.request;
+    if (request.method !== "GET") return;
+    const url = new URL(request.url);
+    if (url.origin !== self.location.origin) return;
+    if (url.pathname.startsWith("/api/") || url.pathname.startsWith("/auth/")) return;
+    event.respondWith(
+        caches.match(request).then((cached) => cached || fetch(request).catch(() => caches.match("/")))
+    );
+});