feat(web): SCEP challenge passwords from the web: mint, list and revoke #190

Summary

Bring cryptosctl scep challenge mint/list/revoke into the FleetOS Manager web. The node already exposes it (MintScepChallenge, ListScepChallenges and RevokeScepChallenge on the node); the manager never calls it.

Acceptance criteria

• The manager proxies the node RPCs with operator-level authorization (viewer read-only, operator and admin as the existing write paths).
• An operator can mint a one-time SCEP challenge (shown once), list active ones and revoke one.
• Tests at the manager API and in the web, through public APIs.

Tasks

• Manager RPC and node client call.
• Web surface on the UI kit.
• Docs.

Notes

Part of #24 (full cryptosctl parity in the FleetOS Manager web). Found by an audit on 2026-10-14 comparing every cryptosctl command with the manager's fleet RPCs: this operation is still CLI-only.