feat(cert-manager): cert role badges + ZIP download in split view

- API: detectCertRole() classifies certs as root/intermediate/end-entity
  via basicConstraints.cA + self-signed check (subject.hash === issuer.hash)
- API: SplitEntry gains certRole field; filenames now reflect role
  (root-ca.pem, intermediate-1.pem, cert.pem)
- Web: SplitTab shows colour-coded role badge per cert
  (red=Root-CA, amber=Zwischen-CA, blue=Zertifikat)
- Web: "Alle als ZIP herunterladen" button via fflate (client-side)
- i18n: add certRole labels + downloadZip action key (de + en)
- i18n: add missing accentColor* and deleteAvatar* keys (de + en)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

apps/web/src/messages/en.json

@@ -125,7 +125,16 @@
       "uploadSuccess": "Profile picture updated successfully.",
       "uploadError": "Upload failed. Please check the file format and size.",
       "ldapManagedNotice": "Your password is managed via the directory (LDAP) and cannot be changed here.",
-      "passwordSectionTitle": "Change Password"
+      "passwordSectionTitle": "Change Password",
+      "accentColorLabel": "Accent Color",
+      "accentColorHelp": "Customizes the primary color of the interface.",
+      "accentColorReset": "Reset",
+      "accentColorSave": "Save color",
+      "accentColorSuccess": "Accent color saved successfully.",
+      "accentColorError": "Failed to save color.",
+      "deleteAvatarCta": "Delete picture",
+      "deleteAvatarSuccess": "Profile picture deleted successfully.",
+      "deleteAvatarError": "Failed to delete picture."
     },
     "sourceDeleteConfirm": "Are you sure you want to delete this calendar source?",
     "sourceDeleteCta": "Delete source",
@@ -463,8 +472,14 @@
       "merge": "Merge",
       "convert": "Convert",
       "download": "Download",
+      "downloadZip": "Download all as ZIP",
       "processing": "Processing..."
     },
+    "certRole": {
+      "root": "Root CA",
+      "intermediate": "Intermediate CA",
+      "end-entity": "Certificate"
+    },
     "emptyState": {
       "inspect": "No certificate loaded.",
       "inspectBody": "Upload a file or paste PEM text.",