[Bugs5382]

What and why

Companion docs for CryptOS-PKI/cryptos-node#288, which adds SCEP (RFC 8894) to the node. This adds one new page under Using CryptOS, Enrol devices with SCEP, and its sidebar entry. No existing page changes.

The page walks an operator through getting a certificate onto a Cisco IOS or IOS-XE trustpoint:

• a SCEP profile with min_rsa_key_bits: 2048 (Cisco trustpoints cannot hold a larger key) and the mandatory allowed_identifier_suffixes;
• switching SCEP on, with a warning callout that the change needs a reboot in a maintenance window, and the Root refusal;
• minting a one-time challenge with cryptosctl scep challenge mint, with a danger callout on handling it;
• checking the CA fingerprint before crypto pki authenticate;
• the trustpoint with an RSA 2048 key in RA mode, crypto pki enroll, and show crypto pki certificates;
• renewal with the current certificate (auto-enroll), the approval queue, and the common failures.

Depends on CryptOS-PKI/cryptos-node#288. The page opens with a callout saying so; it describes behaviour that is true once that PR is in the image. Merge the two together.

Refs CryptOS-PKI/cryptos-node#185

Verification

• Build succeeds (npm run build, no broken links)
• Documentation updated

How this was verified

Every config key, cryptosctl verb and flag, error string and output line on the page was checked against the cryptos#288 code: config: pki.scep: must not be set on a root node, the scep challenge mint output, status -o json field names (protocol, configured, running), identity show -o pem, and the port default. The SCEP server itself was exercised with sscep 0.10.0 in the cryptos tests.

The Cisco IOS-XE commands (crypto key generate rsa ... modulus 2048, the trustpoint with enrollment mode ra, subject-alt-name, serial-number none, ip-address none, hash sha256, auto-enroll 70 regenerate, and the enrolment prompts) have not yet been run against this server on a real switch. That check is owed on a C9300X before the page is final.

---

Before merging: add a closing comment summarizing what was actually done in this PR
(not just the checked boxes).

[Bugs5382]

Closing summary: adds the Enrol devices with SCEP page under Using CryptOS and its sidebar entry: a SCEP profile sized for Cisco trustpoints, the one-time challenge, the IOS-XE trustpoint and enrolment, and renewal with the held certificate. It is the companion page for CryptOS-PKI/cryptos-node#288 and says at the top that it applies once that change is in the image; it reaches main before cryptos#288 merges, so the callout carries it until then. Rebased onto docs/stub-pages (now level with main, including the theme, the VMCA pages and the install pages) with every commit signed off; npm run build passes with no broken links. Merged with a merge commit so each signed-off commit reaches the parent PR's DCO check intact.