feat(sidecar): expose certificate authority status

[kev1n77]

Summary

• inspect the sidecar CA files and expose a versioned read-only certificate status through the desktop API
• parse certificate subject, validity window, and full SHA-256 fingerprint
• report CA, private-material, and trust states without claiming unsupported platform protection
• surface CA status in the Capture sidebar and update CAP-005 progress to 25%

Scope

This is the first CAP-005 increment. It does not implement Windows DACL validation, system trust installation/removal, or privileged CA lifecycle operations.

Verification

• cargo fmt --check (workspace and Tauri)
• cargo test --workspace --all-targets
• workspace and Tauri cargo clippy -- -D warnings
• Tauri tests: 10 passed
• desktop tests: 16 passed
• desktop production build
• Python sidecar tests: 17 passed
• desktop visual QA at 1280x720