feat(pki-server): add OCSP responder and close server release

Add durable multi-authority OCSP responders with strict request parsing,
issuer-bound serial lookup, stable revocation views, signed responses,
nonce policies and bounded protocol execution.

Complete in-process and packaged OCSP validation and close the PKI server
after the final architecture, security and release audit.

docs/pki-server-trusted-proxy-rfc9440-example.json

@@ -1,5 +1,5 @@
 {
-  "version": 4,
+  "version": 5,
   "serverName": "zeroecho-admin-proxy",
   "realm": {
     "realmId": "production",