List and query TLS certificates in the active scope

Returns the paginated collection of TLS certificates (Key Vault certificates / managed certs) visible in the active tenant/subscription/project scope. This single endpoint serves both the plain Certificates page load (keys.certificate.list) and the interactive search/filter/sort/pagination controls (keys.certificate.search_filter_sort): free-text q matches certificate name, subject CN, and issuer CN; the status facet mirrors the UI counter chips (All / Valid / Expiring / Expired); sort accepts the sortable columns name and expiry (notAfter) with order asc|desc. No resource state is mutated by this call. Validation: scopeId must resolve to a scope the caller can read, else 403 FORBIDDEN; unknown scope → 404 NOT_FOUND; status must be one of valid|expiring|expired, sort one of name|expiry, page>=1, pageSize within bounds, else 422 VALIDATION_FAILED. Async & state: Synchronous read; no state change. Always 200 with { data, meta }; never a naked array. Errors: 401 when unauthenticated; 403 when the caller lacks reader access to the scope; 404 when scopeId does not exist; 422 on malformed query parameters; 500 on backend failure. Idempotency/Concurrency: Safe, cacheable; no idempotency key required.