feat(cert-manager): Zusammenführen mit Fullchain und Nur Kette

- Kettenbau mit Aussteller- und Signaturprüfung (checkIssued plus verify), Wurzel nur auf Wunsch
- build-Route für Fullchain und Nur Kette (PEM), eigene JSON-Grenze 512 KiB mit 413 und Code tooLarge
- Reiter Zusammenführen mit Kettenansicht, Hinweis bei fehlendem Zwischenzertifikat

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

apps/web/src/messages/en.json

@@ -1253,7 +1253,8 @@
     "description": "Collect, check and convert certificates, intermediate certificates, keys and requests into the format you need.",
     "tabs": {
       "files": "Files",
-      "filesWithCount": "Files ({count})"
+      "filesWithCount": "Files ({count})",
+      "merge": "Merge"
     },
     "roles": {
       "end-entity": "Server certificate",
@@ -1311,6 +1312,30 @@
       "aiaNotIssuer": "The address did not deliver a matching certificate of the issuer.",
       "aiaUnreachable": "The issuer's server cannot be reached. Download the certificate yourself and add it.",
       "aiaTooLarge": "The issuer's answer is too large and was discarded."
+    },
+    "workspace": {
+      "empty": "No files yet. Upload your certificates in the “Files” tab.",
+      "goToFiles": "Go to the “Files” tab",
+      "basis": "{count, plural, one {Based on 1 file from the “Files” tab.} other {Based on # files from the “Files” tab.}}"
+    },
+    "merge": {
+      "intro": "Tessera orders the server certificate, intermediate certificates and root certificate itself and checks that each certificate was really issued by the next one. The order of your files does not matter.",
+      "noCertificates": "No certificate has been recognised in the files yet. Add a certificate in the “Files” tab.",
+      "chooseHead": "For which certificate should the chain be built?",
+      "includeRoot": "Include root certificate",
+      "noRootAvailable": "The root certificate is not among your files. Most servers do not need it anyway.",
+      "downloadFullchain": "Download fullchain",
+      "downloadChain": "Download chain only",
+      "busy": "Creating …",
+      "chainNeedsIssuer": "An intermediate certificate is missing for “chain only”. Add it in the “Files” tab."
+    },
+    "chain": {
+      "issuedBy": "Issued by {name}",
+      "validUntil": "Valid until {date}",
+      "unknownIssuer": "unknown",
+      "gapAfterLeaf": "Intermediate certificate missing: “{name}”",
+      "gapAfterLeafHint": "Without this certificate some devices will not trust the server. Add it in the “Files” tab.",
+      "gapAfterCa": "A certificate above this one is missing, usually the root certificate “{name}”. A fullchain without the root does not need it."
     }
   },
   "tenderRadar": {