An internal certificate authority replacing self-signed certs

Deployed a real internal Certificate Authority for non-public infrastructure — a two-tier root/intermediate design where the root private key never touches git, CI or any running system. Replaces the ad hoc, individually self-signed certificates every internal service used before, none of which shared a common trust anchor. This phase covers the CA itself going live and healthy; migrating actual internal traffic onto it is tracked separately under Phase 8.11.