feat(fleet): CA key escrow export and import with audit

[Bugs5382]

What and why

Add admin-gated, audited ExportCAKey and ImportCAKey FleetService handlers so an admin can back up a node's CA key to an encrypted envelope and restore it onto a fresh node, entirely through the manager. Encryption is node-side; the manager only relays the encrypted envelope and the passphrase (in transit, never persisted).

• NodeConn + nodeclient.Client gain ExportCAKey/ImportCAKey, mirroring the neighboring node calls.
• Handlers mirror the merged RevokeCertificate shape for authz + dial + audit. Both are admin-only; a viewer/operator is denied before any dial or audit.
• Passphrase length is enforced (at least 18 bytes) as defense in depth; the rejection never echoes the passphrase.
• The passphrase and envelope are never logged or audited. Audit summaries name the node (and, for import, the restored subject) only; a test asserts no summary contains the passphrase.
• A node's FailedPrecondition (TPM non-exportable on export; identity-exists on import) maps to a clear, secret-free message and writes no audit event.

Merge order

Depends on CryptOS-PKI/api#64 (the escrow RPCs). This branch pins api to that branch's pseudo-version; after api#64 merges, re-pin go.mod to merged-main (unset GOPROXY; go get github.com/CryptOS-PKI/api@main && go mod tidy), then merge this. Merge api first, then this and the web PR.

Closes #33
Part of #24

Verification

• Lint clean
• Tests pass
• Build succeeds

How this was verified

task ci (fmt + vet + golangci-lint + test) and task license both green locally; go build ./... clean.