fix(auth): tell a first-run operator where the first certificate comes from (#106)

On a fleet nobody has logged in to yet, the no-certificate denial told the
reader their fleet operator issues the certificate. At first run the reader is
the operator and no certificate exists yet, so the landing page was a dead end.

The install help now carries a short first-run section: issue the first admin
credential from the operator CA the manager trusts (operatorCAPath), and a link
to the deployment guide section with the OpenSSL recipe.

Refs #70

Author: Bugs5382

src/components/layout/certificate-help.test.tsx

@@ -54,4 +54,20 @@ describe("CertificateHelp", () => {
 
     expect(screen.getByText(/reload/i)).toBeInTheDocument();
   });
+
+  // On a fleet nobody has logged in to yet, "your fleet operator issues the
+  // certificate" names someone who does not exist: the person reading this is
+  // the operator, and no certificate has been issued (#70). Until the manager
+  // can mint the first one itself, say where it comes from instead of leaving
+  // them at a dead end.
+  it("tells someone standing up a new fleet where the first certificate comes from", () => {
+    render(<CertificateHelp />);
+
+    expect(screen.getByRole("heading", { name: /new fleet/i })).toBeInTheDocument();
+    expect(screen.getByText(/operatorCAPath/)).toBeInTheDocument();
+    expect(screen.getByRole("link", { name: /deployment guide/i })).toHaveAttribute(
+      "href",
+      expect.stringMatching(/manager\/blob\/main\/docs\/deploying-standalone\.md#3-/),
+    );
+  });
 });

src/components/layout/certificate-help.tsx

@@ -25,6 +25,9 @@ limitations under the License.
 // certificate during the TLS handshake, so this page cannot trigger the prompt
 // -- hence the reload step, which is the part people otherwise miss.
 
+const FIRST_CREDENTIAL_GUIDE =
+  "https://github.com/CryptOS-PKI/manager/blob/main/docs/deploying-standalone.md#3-the-operator-ca-does-not-have-to-be-a-cryptos-node";
+
 interface Platform {
   /** Shell command that performs the import, where one exists. */
   command?: string;
@@ -92,5 +95,25 @@ export const CertificateHelp = () => (
         {p.note ? <p className="italic">{p.note}</p> : null}
       </div>
     ))}
+
+    {/* On a fleet nobody has logged in to yet there is no one to issue the
+        certificate but the reader, and this page cannot mint it (#70). */}
+    <div className="flex flex-col gap-1">
+      <h3 className="text-primary">Standing up a new fleet?</h3>
+      <p>
+        No operator certificate exists until the first one is issued. Issue it yourself from the
+        operator CA this manager trusts (<code>operatorCAPath</code> in its config), with the admin
+        level extension, then install it as above. The{" "}
+        <a
+          className="text-primary underline underline-offset-2"
+          href={FIRST_CREDENTIAL_GUIDE}
+          rel="noreferrer"
+          target="_blank"
+        >
+          deployment guide
+        </a>
+        , section 3, has the full OpenSSL recipe.
+      </p>
+    </div>
   </div>
 );