feat(web): CA key escrow export and import with strong guards

[Bugs5382]

What and why

Add admin-only CA key escrow flows to the node detail panel. Export backs up a node's CA key to an encrypted envelope (downloaded as <node>-ca-backup.enc); import restores an identity onto a fresh node from an uploaded envelope. Encryption stays node-side; the manager relays the encrypted envelope and the plaintext key never reaches the browser.

• Export dialog is double-guarded: the button stays disabled until BOTH a passphrase of at least 18 characters (typed or generated with crypto.getRandomValues) AND an in-UI typed confirmation (the node name or the word EXPORT) are present. No native confirm.
• Import dialog requires an uploaded envelope plus a passphrase and surfaces the node's already-has-identity / non-exportable errors inline.
• Passphrase length is enforced client-side too; the passphrase is never rendered back or logged, and the envelope is downloaded, not displayed.
• escrow.ts branches on fleetMode() (coherent mock, no silent fallback); errors surface to the caller. Actions are admin-only in the node detail panel.
• Regenerated fleet bindings for the new RPCs.

Merge order

Depends on CryptOS-PKI/api#64 (the escrow RPCs, whose regenerated TS bindings are vendored here) and the manager escrow handlers (CryptOS-PKI/manager#52). Merge api first.

Closes #66
Part of CryptOS-PKI/manager#24

Verification

• Lint clean
• Tests pass
• Build succeeds

How this was verified

npm run lint, npm test (195 passing), and npm run build all green locally.