Adds document signing ca and certificate setup

[rolandboon]

Companion to #71 (Yubikey code signing) and #76 (GPG Code Signing CA). Where those PRs secures code by verifying Git commit signatures, this PR secures documents by enabling developers to sign PDFs with a CA-issued certificate.

Adds the 10KB Document Signing CA and a setup flow for creating personal X.509 signing certificates.

1. Migration installs the CA certificate in the system trust store, so signed documents are recognized as trusted.

2. New menu item (Security > Create document signing certificate) lets developers generate a personal signing certificate:

   • Generates an RSA 4096 key + CSR
   • Signs it with the Document Signing CA (fetched via a time-limited Bitwarden Send link, same pattern as Adds configuration helper to setup yubikey for ssh and gpg #71)
   • Creates a PKCS#12 bundle (~/.pdf-signing/signing-cert.p12) for use with pyHanko
   • Backs up the certificate to Bitwarden (Medewerkers/)
   • Securely removes the CA private key from the machine