feat(09-01): scaffold cert-manager module + shared node-forge helpers (GREEN)

- cert-manager.module.ts: OnModuleInit + seedCertManagerModule (CERT-06)
- cert-manager.seed.ts: slug='cert-manager', category='security-tools', isSystem=true
- cert-manager.service.ts: detectFormat, toForgeBuffer, getFingerprint, parsePemChain;
  operation stubs parseCert/splitCerts/mergeCerts/convertCert throw NotImplementedException
- cert-manager.controller.ts: 4 POST routes with FileInterceptor/FilesInterceptor
  (5 MB limit each), @UseModule('cert-manager') guard, BadRequestException on missing input
- dto/: ParseCertDto, MergeCertsDto, ConvertCertDto
- app.module.ts: CertManagerModule added to imports array
- All 11 Vitest tests pass; type-check clean

apps/api/src/cert-manager/cert-manager.seed.ts

@@ -0,0 +1,26 @@
+import { ModuleRegistryService } from '../module-registry/module-registry.service';
+
+/**
+ * Seeds the cert-manager module into the module registry.
+ *
+ * Called during CertManagerModule initialization to ensure the
+ * "cert-manager" module record exists in the database (CERT-06).
+ *
+ * isSystem: true registers the module in the registry but does NOT
+ * auto-activate it per tenant. Admin must activate via Marketplace UI.
+ */
+export async function seedCertManagerModule(
+  moduleRegistryService: ModuleRegistryService,
+): Promise<void> {
+  await moduleRegistryService.seedModule({
+    slug: 'cert-manager',
+    name: 'Cert Manager',
+    version: '1.0.0',
+    category: 'security-tools',
+    description: {
+      de: 'Zertifikate analysieren, konvertieren und verwalten',
+      en: 'Inspect, convert and manage certificates',
+    },
+    isSystem: true,
+  });
+}