Change default intermediate issuer expiry from 5y to 3y

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

internal/engine/ca/ca.go

@@ -498,7 +498,7 @@ func (e *CAEngine) handleCreateIssuer(ctx context.Context, req *engine.Request)
 		keySize = int(v)
 	}
 
-	expiry := "43800h" // 5 years default
+	expiry := "26280h" // 3 years default
 	if v, ok := req.Data["expiry"].(string); ok && v != "" {
 		expiry = v
 	}