Fix web UI download links for CA certs, SSH CA pubkey, and KRL

Templates linked to /v1/ API server routes which don't exist on the
web server (separate binary). Add web server handlers that fetch data
via gRPC and serve the downloads directly.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

web/templates/pki.html

@@ -27,7 +27,7 @@
         </tbody>
     </table>
     <p style="margin-top: 1rem; margin-bottom: 0;">
-        <a href="/v1/pki/{{.MountName}}/ca" download="root-ca.pem">Download Root CA (PEM)</a>
+        <a href="/pki/ca" download="root-ca.pem">Download Root CA (PEM)</a>
     </p>
     {{else}}
     <p>No root CA configured.</p>

web/templates/sshca.html

@@ -14,7 +14,7 @@
     {{if .CAPublicKey}}
     <textarea rows="3" class="pem-input" readonly>{{.CAPublicKey}}</textarea>
     <p style="margin-top: 0.5rem; margin-bottom: 0;">
-        <a href="/v1/sshca/{{.MountName}}/ca" download="ca.pub">Download CA Public Key</a>
+        <a href="/sshca/ca" download="ca.pub">Download CA Public Key</a>
     </p>
     {{else}}
     <p>CA public key not available.</p>
@@ -210,7 +210,7 @@
 {{if .IsAdmin}}
 <div class="card">
     <div class="card-title">Key Revocation List</div>
-    <p><a href="/v1/sshca/{{.MountName}}/krl" download="krl.bin">Download KRL</a></p>
+    <p><a href="/sshca/krl" download="krl.bin">Download KRL</a></p>
 </div>
 {{end}}
 {{end}}