Fix web UI download links for CA certs, SSH CA pubkey, and KRL

Templates linked to /v1/ API server routes which don't exist on the
web server (separate binary). Add web server handlers that fetch data
via gRPC and serve the downloads directly.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

web/templates/pki.html

@@ -27,7 +27,7 @@
         </tbody>
     </table>
     <p style="margin-top: 1rem; margin-bottom: 0;">
-        <a href="/v1/pki/{{.MountName}}/ca" download="root-ca.pem">Download Root CA (PEM)</a>
+        <a href="/pki/ca" download="root-ca.pem">Download Root CA (PEM)</a>
     </p>
     {{else}}
     <p>No root CA configured.</p>