feat(pki-server): add ACME certificate management

Add directory-bound ACME accounts, orders, authorizations, challenge
evidence, strict JWS processing, issuance, rollover and revocation.

Isolate bounded ACME execution from administrative and public services
while preserving explicit authority, profile, issuer and chain-path
selection.

docs/pki-server-production-example.json

@@ -1,5 +1,5 @@
 {
-  "version": 3,
+  "version": 4,
   "serverName": "zeroecho-admin",
   "realm": {
     "realmId": "production",
@@ -75,5 +75,6 @@
     "forcedShutdownMillis": 10000
   },
   "publicListener": {"enabled": false},
+  "acmeListener": {"enabled": false},
   "runtime": {}
 }