Add server template apply modes, bulk revocation, explicit DN order and detail tabs

README.md

@@ -78,8 +78,10 @@ explicit/mandatory DN entries, default key type/size, default validity).
 - Issue self-signed certificates or certificates signed by a CA in the same
   vault, from scratch or from a request. Imported CSRs are marked **signed**
   once a certificate is issued from them.
-- The certificate wizard covers subject entries, validity, basic constraints,
-  key usage, extended key usage, SAN/IAN, subject/authority key identifiers,
+- The certificate wizard covers subject entries in the vault's explicit DN
+  order, additional subject attributes, mandatory DN enforcement, validity,
+  basic constraints, key usage, extended key usage, SAN/IAN,
+  subject/authority key identifiers,
   CRL distribution points, authority information access, name constraints,
   certificate policies, policy constraints, inhibit-any-policy, OCSP no-check,
   TLS feature (OCSP stapling), Netscape legacy extensions and raw
@@ -87,14 +89,18 @@ explicit/mandatory DN entries, default key type/size, default validity).
   advanced extensions plus an advanced JSON editor for raw/less common
   extensions, and a server-side **Validate extensions** action. OpenSSL config
   text is available on export.
-- Certificate details show subject/issuer, serial, validity, signatures,
-  MD5/SHA-1/SHA-256 fingerprints, parsed extensions, OpenSSL validation
-  errors, purposes and the issuer chain.
+- Certificate details are split into Overview, Extensions, Validation, Export,
+  Metadata, Revoke, Transform and CA tabs, with hash deep links. They show
+  subject/issuer, serial, validity, signatures, MD5/SHA-1/SHA-256
+  fingerprints, parsed extensions, OpenSSL validation errors, purposes and the
+  issuer chain.
 - Renew with a new or kept serial, optionally revoke/replace the old
   certificate. Revoke with a reason; manage the CA's revocation list manually,
-  including revocation dates and invalidity dates. CA properties (CRL days and
-  default signing template, including built-ins) are editable from the CA
-  detail page.
+  including revocation dates and invalidity dates. Certificate lists support
+  bulk revocation with a shared reason and invalidity date. CA properties
+  (CRL days and default signing template, including built-ins) are editable
+  from the CA detail page, and the wizard offers the CA default template
+  explicitly without overwriting edits.
 - Absolute validity dates and XCA's "no well-defined expiration" mode are
   supported alongside duration-based validity.
 - Transform certificates to a public key, a CSR or a template.
@@ -114,8 +120,9 @@ DER or vCalendar.
 Built-in **CA**, **TLS server** and **TLS client** templates mirror XCA's
 presets. User templates store subject defaults, extension defaults and a
 relative validity range. XCA's binary template format is supported for import
-and export, and templates can be applied to a certificate/request spec
-server-side.
+and export, and templates are applied to a certificate/request spec
+server-side with **Apply all**, **Subject only**, and **Extensions + validity**
+modes.
 
 ### Import and migration
 
@@ -148,7 +155,7 @@ OpenAPI JSON is at `/api/openapi.json`; Swagger UI at `/api/docs`.
 | Vaults | `GET/POST /api/vaults`, `GET/PATCH/DELETE /api/vaults/{id}`, `GET/PATCH /api/vaults/{id}/settings`, `GET /api/vaults/{id}/summary`, `GET /api/vaults/{id}/options`, `GET /api/vaults/{id}/search`, `POST /api/vaults/{id}/export` |
 | Keys | `GET/POST /api/vaults/{id}/keys`, `GET/PATCH/DELETE .../keys/{key_id}`, `POST .../keys/{key_id}/export` |
 | Requests | `GET/POST /api/vaults/{id}/requests`, `GET/PATCH/DELETE .../{id}`, `POST .../{id}/export`, `POST .../{id}/transform/open-key`, `POST .../{id}/transform/template` |
-| Certificates | `GET/POST /api/vaults/{id}/certificates`, `POST /api/vaults/{id}/certificates/preview`, `GET/PATCH/DELETE .../{id}`, `POST .../{id}/export`, `POST .../{id}/renew`, `POST .../{id}/revoke`, `GET/PATCH .../{id}/ca`, `GET/POST .../{id}/revocations`, `PATCH/DELETE .../revocations/{rev_id}`, `POST .../{id}/crl`, `POST .../{id}/tls-auth`, transforms |
+| Certificates | `GET/POST /api/vaults/{id}/certificates`, `POST /api/vaults/{id}/certificates/preview`, `GET/PATCH/DELETE .../{id}`, `POST .../{id}/export`, `POST .../{id}/renew`, `POST .../{id}/revoke`, `POST /api/vaults/{id}/certificates/bulk-revoke`, `GET/PATCH .../{id}/ca`, `GET/POST .../{id}/revocations`, `PATCH/DELETE .../revocations/{rev_id}`, `POST .../{id}/crl`, `POST .../{id}/tls-auth`, transforms |
 | CRLs | `GET /api/vaults/{id}/crls`, `GET/DELETE .../{crl_id}`, `POST .../{crl_id}/export` |
 | Templates | `GET/POST /api/vaults/{id}/templates`, `GET/PATCH/DELETE .../{template_id}`, `POST .../{template_id}/apply`, `POST .../{template_id}/export` |
 | Import | `POST /api/vaults/{id}/import` (`dry_run`, `selected`, `xca_db`) |