feat(fleet): add RekeyNode RPC

[Bugs5382]

Summary

Add a FleetService.RekeyNode RPC so an operator can re-key a subordinate CA in one orchestrated manager call. The manager has the child mint a new key + CSR, routes the CSR to the parent (resolved from the child's issuer CN) for signing, and delivers the signed chain back to the child.

Acceptance criteria

• RekeyNode(RekeyNodeRequest) returns (RekeyNodeResponse) added to FleetService.
• RekeyNodeRequest carries node_name and profile_name; RekeyNodeResponse carries subject_cn, issuer_cn, chain_len.
• Go and TypeScript stubs regenerated.

Notes

Part of the Fleet Manager cryptosctl-parity work. The node-side BeginKeyRotation/CompleteKeyRotation RPCs already exist; this adds only the manager-facing orchestration surface.