feat(cert-manager): Schlüssel, PFX und CSR erkennen, Passwort je Datei

- Private Schlüssel (PKCS#1, PKCS#8, SEC1; PEM und DER; unverschlüsselt, verschlüsselt, klassisch verschlüsselt) für RSA und EC über node:crypto
- PKCS#12 lesen (OpenSSL 3, kompatibel, RC2; EC-Zertifikate und -Schlüssel), auch ohne Endung und im ZIP
- Zertifikatsanfragen (CSR) als PEM und DER mit Inhaber, SAN und Schlüssel
- Zuordnung von Schlüssel und Anfrage zum Zertifikat (checkPrivateKey, SPKI-Vergleich)
- Feld passwords je Datei, gesperrte Dateien fragen nach dem Passwort; kein Passwort in Antwort oder Log
- Oberfläche: Passwortfeld mit Anzeigen/Verbergen, Schlüssel- und Anfragekarten im Reiter Analysieren

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

apps/web/src/messages/en.json

@@ -1303,7 +1303,17 @@
       "pasteLabel": "Pasted PEM text",
       "pasteAdd": "Add",
       "pastedLabel": "Pasted text {n}",
-      "originPaste": "Pasted text"
+      "originPaste": "Pasted text",
+      "locked": {
+        "message": "\"{path}\" is password protected.",
+        "optional": "\"{path}\" is password protected. You do not need the file as long as the certificate and the key are already there.",
+        "passwordLabel": "Password for \"{name}\"",
+        "unlock": "Unlock",
+        "unlockAnyway": "Unlock anyway",
+        "wrong": "The password does not match.",
+        "note": "The password stays in this browser window and is only sent to open the file."
+      },
+      "keyWasEncrypted": "was encrypted"
     },
     "errors": {
       "generic": "The files could not be checked. Please try again.",
@@ -1351,7 +1361,25 @@
         "end-entity": "The actual certificate for your domain. This one belongs on the web server.",
         "intermediate": "Vouches for your server certificate towards the browser. It is installed together with the server certificate (chain).",
         "root": "The top certificate authority. Browsers and operating systems usually have it already."
-      }
+      },
+      "matchingKey": "Matching key present",
+      "keysTitle": "Private keys",
+      "csrsTitle": "Certificate requests",
+      "lockedTitle": "Protected files",
+      "lockedNeeded": "needs a password",
+      "lockedWrong": "The password does not match",
+      "lockedHint": "Enter the password in the \"Files\" tab.",
+      "wasEncrypted": "Was encrypted",
+      "belongsTo": "Belongs to",
+      "noCertificateYet": "There is no certificate for it yet.",
+      "subject": "Owner",
+      "matchedKey": "Matching key",
+      "matchedCertificates": "Matching certificate",
+      "matchedCsr": "Matching request",
+      "present": "present",
+      "absent": "not present",
+      "explainKey": "Belongs to your server certificate and stays secret. Never pass it on.",
+      "explainCsr": "The request used to order a certificate from the certification authority."
     },
     "split": {
       "intro": "You can download every recognised part on its own in its natural format, or all of them together as a ZIP.",
@@ -1379,6 +1407,10 @@
       "gapAfterLeaf": "Intermediate certificate missing: “{name}”",
       "gapAfterLeafHint": "Without this certificate some devices will not trust the server. Add it in the “Files” tab.",
       "gapAfterCa": "A certificate above this one is missing, usually the root certificate “{name}”. A fullchain without the root does not need it."
+    },
+    "passwordInput": {
+      "show": "Show password",
+      "hide": "Hide password"
     }
   },
   "tenderRadar": {