Add web UI for SSH CA, Transit, and User engines; full security audit and remediation

Web UI: Added browser-based management for all three remaining engines
(SSH CA, Transit, User E2E). Includes gRPC client wiring, handler files,
7 HTML templates, dashboard mount forms, and conditional navigation links.
Fixed REST API routes to match design specs (SSH CA cert singular paths,
Transit PATCH for update-key-config).

Security audit: Conducted full-system audit covering crypto core, all
engine implementations, API servers, policy engine, auth, deployment,
and documentation. Identified 42 new findings (#39-#80) across all
severity levels.

Remediation of all 8 High findings:
- #68: Replaced 14 JSON-injection-vulnerable error responses with safe
  json.Encoder via writeJSONError helper
- #48: Added two-layer path traversal defense (barrier validatePath
  rejects ".." segments; engine ValidateName enforces safe name pattern)
- #39: Extended RLock through entire crypto operations in barrier
  Get/Put/Delete/List to eliminate TOCTOU race with Seal
- #40: Unified ReWrapKeys and seal_config UPDATE into single SQLite
  transaction to prevent irrecoverable data loss on crash during MEK
  rotation
- #49: Added resolveTTL to CA engine enforcing issuer MaxTTL ceiling
  on handleIssue and handleSignCSR
- #61: Store raw ECDH private key bytes in userState for effective
  zeroization on Seal
- #62: Fixed user engine policy resource path from mountPath to
  mountName() so policy rules match correctly
- #69: Added newPolicyChecker helper and passed service-level policy
  evaluation to all 25 typed REST handler engine.Request structs

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

web/templates/sshca_cert_detail.html

@@ -0,0 +1,60 @@
+{{define "title"}} - SSH Certificate: {{.Cert.Serial}}{{end}}
+{{define "content"}}
+<div class="page-header">
+    <h2>SSH Certificate: <code>{{.Cert.Serial}}</code></h2>
+    <div class="page-meta">
+        <a href="/sshca">&larr; SSH CA</a>
+    </div>
+</div>
+
+<div class="card">
+    <div class="card-title">Details</div>
+    <table class="kv-table">
+        <tbody>
+            <tr><th>Serial</th><td><code>{{.Cert.Serial}}</code></td></tr>
+            <tr><th>Type</th><td>{{.Cert.CertType}}</td></tr>
+            <tr><th>Key ID</th><td>{{.Cert.KeyID}}</td></tr>
+            <tr><th>Principals</th><td>{{range .Cert.Principals}}<code>{{.}}</code> {{end}}</td></tr>
+            <tr><th>Profile</th><td>{{if .Cert.Profile}}<a href="/sshca/profile/{{.Cert.Profile}}">{{.Cert.Profile}}</a>{{else}}&mdash;{{end}}</td></tr>
+            <tr><th>Issued By</th><td>{{.Cert.IssuedBy}}</td></tr>
+            <tr><th>Issued At</th><td>{{.Cert.IssuedAt}}</td></tr>
+            <tr><th>Expires At</th><td>{{.Cert.ExpiresAt}}</td></tr>
+            <tr>
+                <th>Revoked</th>
+                <td>
+                    {{if .Cert.Revoked}}
+                    <span class="badge badge-danger">Revoked</span>
+                    {{if .Cert.RevokedAt}} at {{.Cert.RevokedAt}}{{end}}
+                    {{if .Cert.RevokedBy}} by {{.Cert.RevokedBy}}{{end}}
+                    {{else}}
+                    No
+                    {{end}}
+                </td>
+            </tr>
+        </tbody>
+    </table>
+</div>
+
+{{if .Cert.CertData}}
+<div class="card">
+    <div class="card-title">Certificate</div>
+    <textarea rows="6" class="pem-input" readonly>{{.Cert.CertData}}</textarea>
+</div>
+{{end}}
+
+{{if .IsAdmin}}
+<div class="card">
+    <div class="card-title">Admin Actions</div>
+    {{if not .Cert.Revoked}}
+    <form method="post" action="/sshca/cert/{{.Cert.Serial}}/revoke" style="display:inline;">
+        {{csrfField}}
+        <button type="submit" class="btn-danger" onclick="return confirm('Revoke certificate {{.Cert.Serial}}?')">Revoke</button>
+    </form>
+    {{end}}
+    <form method="post" action="/sshca/cert/{{.Cert.Serial}}/delete" style="display:inline; margin-left: 0.5rem;">
+        {{csrfField}}
+        <button type="submit" class="btn-danger" onclick="return confirm('Permanently delete certificate {{.Cert.Serial}}?')">Delete</button>
+    </form>
+</div>
+{{end}}
+{{end}}