[Bugs5382]

What and why

Companion to the web change that brings the Operators page onto the external operator CA model (CryptOS-PKI/cryptos-web#145). Merge the two together.

Refs CryptOS-PKI/cryptos-web#144

• New page Adding operators in the web UI (Fleet Manager section): what the Operators page lists (kind, issuer, denylisted, CRL-revoked, last seen, pending requests), requesting a credential with a key made in the browser or a CSR from the holder, the key backup with its passphrase shown once, signing at the CA, completing a request (key backup held in the tab, a key backup file, or the holder keeps the key) and the PKCS#12 sealed with the backup's passphrase, recording a certificate made at the CA, cancelling, and denying with an RFC 5280 reason and a note.
• New page Make a credential request: the anonymous /request-credential page where a future operator makes their own key, key backup and CSR, and later builds their PKCS#12, all in the browser, plus the equivalent openssl pkcs12 -export command.
• The web UI page: the Operators section describes the new actions and links to both pages; the login section points someone without a certificate at the request page. The sidebar lists the two pages after The web UI.

Callouts: :::danger for the passphrase shown once (twice, one per page), :::warning for the non-critical level extension and for denying not revoking at the CA, :::caution before-you-start on each page.

Merge order: with CryptOS-PKI/cryptos-web#145. It doesn't touch the lines #73 changes in web-ui.md and sidebars.ts, so either can merge first. Once both are in, docs#73's note that the web screens for requests aren't in this release can go.

Verification

• Build succeeds
• Documentation updated (if behavior or API changed)

How this was verified

npm run build completes with no broken links, and task license passes. The screen text, button names, file names and messages were checked against the web change. The key backup and the PKCS#12 the browser builds were opened with OpenSSL 3 (openssl pkey and openssl pkcs12 -info: PBES2, PBKDF2-HMAC-SHA256, AES-256-CBC, the friendly name shown), and the openssl pkcs12 -export command was run as written against a PBES2 encrypted key.

[Bugs5382]

Merging for the v0.1.0 test run: CI green and mergeable at merge time.