feat(cert-manager): Fehlendes Zertifikat holen, gehärteter Adressschutz

- Neuer Knopf „Fehlendes Zertifikat holen“ nur auf Klick: POST fetch-issuer liest die
  Aussteller-Adresse (AIA) serverseitig aus dem Zertifikat, nie vom Browser; nur Standardport,
  Adressschutz vor jedem Sprung, Aufloesung beim Verbinden geprueft, 8 s und 256 KiB, hoechstens
  3 Weiterleitungen; angenommen wird nur ein Zertifikat, das wirklich ausgestellt hat
- Geholte Zertifikate erscheinen als „nachgeladen von <Server>“ in der Liste und auf der Karte
- Gemeinsamer Adressschutz gehaertet: versteckte IPv6-Schreibweisen interner Adressen
  (IPv4-gemappt in Hex, NAT64, 6to4, Teredo, Zonenkennung u. a.), neues Spec
- Modul-Changelog 1.2.0, CHANGELOG (Sicherheit), drei Anleitungen

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

apps/web/src/messages/en.json

@@ -1315,7 +1315,8 @@
         "wrong": "The password does not match.",
         "note": "The password stays in this browser window and is only sent to open the file."
       },
-      "keyWasEncrypted": "was encrypted"
+      "keyWasEncrypted": "was encrypted",
+      "fetchedFrom": "fetched from {host}"
     },
     "errors": {
       "generic": "The files could not be checked. Please try again.",
@@ -1422,7 +1423,15 @@
       "unknownIssuer": "unknown",
       "gapAfterLeaf": "Intermediate certificate missing: “{name}”",
       "gapAfterLeafHint": "Without this certificate some devices will not trust the server. Add it in the “Files” tab.",
-      "gapAfterCa": "A certificate above this one is missing, usually the root certificate “{name}”. A fullchain without the root does not need it."
+      "gapAfterCa": "A certificate above this one is missing, usually the root certificate “{name}”. A fullchain without the root does not need it.",
+      "fetchButton": "Fetch missing certificate",
+      "fetching": "Fetching …",
+      "fetchHint": "Only when you click, Tessera asks {host}, the issuer address named in the certificate. Nothing is fetched automatically.",
+      "fetchNoAddress": "The certificate names no address to fetch from. Download the missing certificate from the issuer and add it in the “Files” tab.",
+      "fetchAlready": "This certificate is already in the list.",
+      "fetchListFull": "The list is full. Remove a file and try again.",
+      "fetchListTooLarge": "The files would be too large together. Remove a file and try again.",
+      "fetchFailed": "The certificate could not be fetched. Please try again later or download it from the issuer."
     },
     "passwordInput": {
       "show": "Show password",