Create (generate or import) a certificate

Implemented: mode=import only. The PEM bundle (leaf first, then intermediates) and its unencrypted RSA-2048/RSA-4096/EC-P256 private key are validated, stored in Barbican as a PKCS12 secret by the project's platform credential and recorded synchronously; the private key is never stored by the platform or returned. mode=generate is refused 422 (field mode): the platform does not issue certificates. A malformed, mismatched, encrypted or expired bundle is 422 on the offending field. Creates a new TLS certificate record in the active scope from the certificate creation form. Two modes are supported: generate (the platform builds a CSR from name/CN/SANs/key algorithm and submits it to the selected issuer — platform managed CA, Let's Encrypt ACME, or external CSR export) and import (the caller pastes an existing certificate PEM bundle plus its private key PEM). On acceptance the certificate becomes discoverable in the scoped certificate list in a transitional state while issuance/import completes. Validation: name must match ^[a-z0-9-]{1,64}$ (lowercase letters, digits, hyphens) → 422 VALIDATION_FAILED; in generate mode commonName is required and keyAlgorithm must be a non-symmetric algorithm (RSA-2048|RSA-4096|EC-P256); in import mode certificatePem and privateKeyPem must each begin with a -----BEGIN PEM block → 422; duplicate certificate name in the scope or scope certificate quota exhausted → 409; referenced issuer must be available. Async & state: Asynchronous; returns 202 with the full Certificate resource in its transitional (issuing/importing) state. Terminal states surface as status valid|expiring|expired; progress is emitted as resource.updated SSE frames (kind: certificate, patch: status/serial/ notBefore/notAfter/thumbprints) until issuance completes. Errors: 401 unauthenticated; 403 caller lacks contributor/admin/owner on the scope; 404 unknown scopeId; 409 quota exceeded or duplicate name; 422 invalid name/CN/PEM input; 500 internal failure. Idempotency/Concurrency: Idempotency-Key is required; replays with the same key return the original 202 result without creating a second certificate.