feat(cert-manager): Zertifikatspaket hochladen, erkennen und in jedem Format herunterladen

Neuer erster Reiter Übersicht: mehrere Dateien oder die ZIP vom Aussteller
auf einmal ablegen. Der Server erkennt jedes Teil (Server-, Zwischen-,
Stammzertifikat, privater Schlüssel, CSR, auch aus PFX/P7B), fasst
Duplikate zusammen, ordnet Schlüssel/CSR dem Zertifikat zu und baut die
Kette. Unter jedem Teil stehen Download-Knöpfe für alle passenden Formate
(crt, cer, Fullchain, p7b, pfx mit Schlüssel und Kette; key PKCS#8/PKCS#1/
DER; csr PEM/DER). Geschützte PFX lassen sich mit Passwort entsperren.

Neue Endpunkte POST analyze (Dateien/ZIP, Begrenzung Anzahl und Größe vor
dem Entpacken) und POST export (JSON, zustandslos). Modultexte siezen jetzt
durchgehend; Gültigkeit in UTC wie im Zertifikat.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

apps/web/src/messages/en.json

@@ -1182,8 +1182,9 @@
   },
   "certManager": {
     "title": "Certificate Manager",
-    "description": "Inspect, split, merge and convert certificates.",
+    "description": "Check certificate bundles and download them in any format; inspect, split, merge and convert single certificates.",
     "tabs": {
+      "overview": "Overview",
       "inspect": "Inspect",
       "split": "Split",
       "merge": "Merge",
@@ -1229,6 +1230,73 @@
       "generic": "Processing failed. Check the file format or password.",
       "wrongPassword": "Wrong password. Could not decrypt the PFX/P12 file.",
       "unknownFormat": "Unknown format. The file could not be recognized as a certificate."
+    },
+    "overview": {
+      "dropTitle": "Drop certificate files or a ZIP here, or click",
+      "dropHint": "Everything at once, as delivered by the issuer: .zip, .pem, .crt, .cer, .key, .csr, .pfx, .p12, .p7b",
+      "removeFile": "Remove {name}",
+      "reset": "Remove all",
+      "analyzing": "Checking files …",
+      "error": "The files could not be checked. Please make sure they are certificate files.",
+      "locked": "Protected: {files}. Enter the password to read this content as well.",
+      "lockedPassword": "Password of the protected file",
+      "unlock": "Unlock",
+      "nothingFound": "No certificate, key or certificate request was found in the files.",
+      "ignored": "Not used (no certificate detected): {files}",
+      "type": {
+        "end-entity": "Server certificate",
+        "intermediate": "Intermediate certificate",
+        "root": "Root certificate",
+        "privateKey": "Private key",
+        "csr": "Certificate request (CSR)"
+      },
+      "explain": {
+        "end-entity": "The actual certificate for your domain – it goes on the web server.",
+        "intermediate": "Vouches for your server certificate towards the browser. Install it together with the server certificate (chain).",
+        "root": "Top-level certificate authority. Usually already present in browsers and operating systems.",
+        "privateKey": "The secret key for the server certificate. Needed on the server, but must never be shared.",
+        "csr": "The request used to order the certificate from the issuer. Only needed for a reissue."
+      },
+      "issuer": "Issued by",
+      "validity": "Valid",
+      "names": "Valid for",
+      "key": "Key",
+      "belongsTo": "Belongs to",
+      "source": "Found in",
+      "valid": "Valid",
+      "expired": "Expired",
+      "expiresSoon": "Expires in {days} days",
+      "keySecret": "Keep secret: whoever has this key can impersonate your website.",
+      "downloading": "Creating …",
+      "exportError": "This file could not be created.",
+      "format": {
+        "crt": "PEM (.crt)",
+        "cer": "DER (.cer)",
+        "fullchain": "With chain (.pem)",
+        "p7b": "PKCS#7 (.p7b)",
+        "pfx": "PFX (.pfx)",
+        "key": "PEM (.key)",
+        "key-rsa": "RSA PEM (.rsa.key)",
+        "key-der": "DER (.key.der)",
+        "csr": "PEM (.csr)",
+        "csr-der": "DER (.csr.der)"
+      },
+      "formatHint": {
+        "crt": "Text format, e.g. for Apache, Nginx and most devices",
+        "cer": "Binary format, e.g. for Windows and Java",
+        "fullchain": "Certificate and chain in one file, e.g. for Nginx",
+        "p7b": "Certificate and chain without key, e.g. for Windows/IIS",
+        "pfx": "Certificate, chain and key in one password-protected file, e.g. for Windows/IIS and Exchange",
+        "key": "Key in standard format (PKCS#8)",
+        "key-rsa": "Key in older RSA format (PKCS#1), for older software",
+        "key-der": "Key as binary file",
+        "csr": "Certificate request as text",
+        "csr-der": "Certificate request as binary file"
+      },
+      "pfxWithKey": "The PFX file contains certificate, chain and private key. Set a password – it is asked for when importing.",
+      "pfxWithoutKey": "No key is available for this certificate – the PFX file contains only certificate and chain. Set a password.",
+      "pfxPassword": "Password for the PFX file",
+      "pfxDownload": "Download PFX"
     }
   },
   "tenderRadar": {