fix(cert-manager): Reiter zeigen nur noch passende Auswertungen, Aufteilen schützt Schlüssel

- Ausgabe-Reiter bieten nur an, was zur aktuellen Dateiliste passt: nach dem Entfernen
  einer Datei oder einer fehlgeschlagenen Prüfung kommt Hinweis oder Fehler mit
  „Erneut versuchen“ statt der alten Auswertung (WR-02)
- Aufteilen: ein in der Datei geschützter Schlüssel bleibt geschützt (Passwort für die
  Ausgabe, auch in der ZIP); ohne Schutz nur ausdrücklich und mit sichtbarem Hinweis;
  Schlüssel heißen nach ihrem Zertifikat (WR-03, IN-05)
- Meldungen: tooManyItems, aiaNotAllowed, buildFailed (statt „Dateien konnten nicht
  geprüft werden“ beim Erstellen), protectionTooExpensive; Hinweis zum Passwort
  genauer (IN-03, IN-05)
- Download-Adresse wird erst nach einer Sekunde widerrufen (IN-04)
- Anleitungen und Änderungsliste: Grenzen, Aufteilen mit Schlüsselschutz, Umlaut-Passwörter

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

apps/web/src/messages/en.json

@@ -1298,7 +1298,8 @@
         "suspicious": "The file is packed unusually tightly and is skipped.",
         "zipTooLarge": "The ZIP contains too much data and is not opened.",
         "tooManyEntries": "The ZIP contains too many files and is not opened.",
-        "unsupportedKey": "This key type is not supported."
+        "unsupportedKey": "This key type is not supported.",
+        "protectionTooExpensive": "The password protection of this file would take too much work to check. It is skipped."
       },
       "pasteToggle": "Paste PEM text",
       "pasteHint": "Paste text that starts with \"-----BEGIN\". Several blocks in a row are fine.",
@@ -1313,7 +1314,7 @@
         "unlock": "Unlock",
         "unlockAnyway": "Unlock anyway",
         "wrong": "The password does not match.",
-        "note": "The password stays in this browser window and is only sent to open the file."
+        "note": "The password stays in this browser window. It is sent along with every check of the files, but never stored."
       },
       "keyWasEncrypted": "was encrypted",
       "fetchedFrom": "fetched from {host}"
@@ -1333,12 +1334,16 @@
       "aiaInternal": "The address in the certificate does not point to a public server and is not contacted.",
       "aiaNotIssuer": "The address did not deliver a matching certificate of the issuer.",
       "aiaUnreachable": "The issuer's server cannot be reached. Download the certificate yourself and add it.",
-      "aiaTooLarge": "The issuer's answer is too large and was discarded."
+      "aiaTooLarge": "The issuer's answer is too large and was discarded.",
+      "buildFailed": "The file could not be created. Please try again.",
+      "tooManyItems": "The files contain too many certificates, keys or requests (at most 200 certificates, 50 keys and 50 requests at once). Remove some files and try again.",
+      "aiaNotAllowed": "The address in the certificate may not be fetched. Only ordinary http or https addresses without credentials and without a special port are allowed. Download the certificate yourself and add it."
     },
     "workspace": {
       "empty": "No files yet. Upload your certificates in the “Files” tab.",
       "goToFiles": "Go to the “Files” tab",
-      "basis": "{count, plural, one {Based on 1 file from the “Files” tab.} other {Based on # files from the “Files” tab.}}"
+      "basis": "{count, plural, one {Based on 1 file from the “Files” tab.} other {Based on # files from the “Files” tab.}}",
+      "stale": "The results do not match your files right now. Please check the files again."
     },
     "analyze": {
       "intro": "Everything recognised in your files: the chains first, then every certificate in detail. All times are shown in UTC, as in the certificate.",
@@ -1385,12 +1390,20 @@
       "explainCsr": "The request used to order a certificate from the certification authority."
     },
     "split": {
-      "intro": "You can download every recognised part on its own in its natural format, or all of them together as a ZIP.",
+      "intro": "You can download every detected part on its own in its natural format, or all together as a ZIP. Private keys stay protected by a password if they already were in your file.",
       "nothingFound": "Nothing has been recognised yet that could be downloaded.",
       "download": "Download",
       "downloadFor": "Download \"{name}\"",
       "downloadAll": "Download all as ZIP",
-      "zipFilename": "Certificates.zip"
+      "zipFilename": "Certificates.zip",
+      "keyNote": "Private keys are secret. Protect the files with a password if you store or pass them on.",
+      "protectKeys": "Protect keys with a password",
+      "keyPassword": "Password for the keys",
+      "keysWereProtected": "At least one key was protected by a password in your file. Without protection the key files are saved unencrypted. Anyone who gets them can use them.",
+      "passwordNeeded": "Please enter a password for the keys, or switch the protection off.",
+      "busy": "Preparing …",
+      "keyProtected": "protected by a password",
+      "keyPlain": "without password protection"
     },
     "merge": {
       "intro": "Tessera orders the server certificate, intermediate certificates and root certificate itself and checks that each certificate was really issued by the next one. The order of your files does not matter.",