feat(09-01): scaffold cert-manager module + shared node-forge helpers (GREEN)

- cert-manager.module.ts: OnModuleInit + seedCertManagerModule (CERT-06)
- cert-manager.seed.ts: slug='cert-manager', category='security-tools', isSystem=true
- cert-manager.service.ts: detectFormat, toForgeBuffer, getFingerprint, parsePemChain;
  operation stubs parseCert/splitCerts/mergeCerts/convertCert throw NotImplementedException
- cert-manager.controller.ts: 4 POST routes with FileInterceptor/FilesInterceptor
  (5 MB limit each), @UseModule('cert-manager') guard, BadRequestException on missing input
- dto/: ParseCertDto, MergeCertsDto, ConvertCertDto
- app.module.ts: CertManagerModule added to imports array
- All 11 Vitest tests pass; type-check clean

apps/api/src/cert-manager/dto/convert-cert.dto.ts

@@ -0,0 +1,8 @@
+/**
+ * DTO for the cert-manager convert endpoint body fields.
+ * Used alongside FileInterceptor for single-file upload.
+ */
+export class ConvertCertDto {
+  targetFormat!: 'pem' | 'der' | 'pfx' | 'p7b';
+  password?: string;
+}

apps/api/src/cert-manager/dto/merge-certs.dto.ts

@@ -0,0 +1,8 @@
+/**
+ * DTO for the cert-manager merge endpoint body fields.
+ * Used alongside FilesInterceptor for multi-file upload.
+ */
+export class MergeCertsDto {
+  outputFormat!: 'pem' | 'pfx';
+  password?: string;
+}

apps/api/src/cert-manager/dto/parse-cert.dto.ts

@@ -0,0 +1,8 @@
+/**
+ * DTO for the cert-manager parse endpoint (text paste / JSON body path).
+ * For file uploads the body fields are extracted via @Body() in the controller.
+ */
+export class ParseCertDto {
+  pemText!: string;
+  password?: string;
+}