feat(sidecar): manage Windows CA trust

[kev1n77]

Summary

• validate local trust anchors before installation and manage exact certificates in Windows CurrentUser ROOT
• expose trust management through the desktop API and Tauri commands, with automatic Gateway fallback before removal
• keep the desktop responsive while Windows presents its protected-root confirmation
• add desktop controls, contract/UI tests, exact in-memory Windows certificate-store lifecycle coverage, and progress tracking updates

Verification

• cargo fmt --all -- --check
• cargo test --workspace --all-targets
• cargo clippy --workspace --all-targets -- -D warnings
• cargo test/clippy for apps/desktop/src-tauri
• npm run desktop:check
• npm run desktop:build
• python -m unittest discover -s sidecars/mitmproxy/tests -v

Windows protected-root writes require an interactive security confirmation. CI validates the same exact-DER add/delete helpers against a native in-memory certificate store; the CurrentUser ROOT round-trip remains an ignored manual acceptance experiment for an interactive Windows session.