🚧 Add CA and server cert management

backend/app/models.py

@@ -150,15 +150,36 @@ class ConfigRevision(Base):
 
 
 class Certificate(Base):
+    """A CA or leaf certificate in the platform PKI store (spec 16-21).
+
+    Hierarchy: a CA row has is_ca=True and parent_id=None (internal
+    self-signed root/intermediate, Release 2 MVP keeps exactly one level).
+    A leaf row points at the CA that signed it. Private keys are stored
+    ENCRYPTED (AES-256-GCM, see app/crypto.py) — never in plaintext.
+    """
+
     __tablename__ = "certificates"
 
     id: Mapped[uuid.UUID] = mapped_column(primary_key=True, default=uuid.uuid4)
     common_name: Mapped[str] = mapped_column(String(200))
     certificate_pem: Mapped[str] = mapped_column(Text)
-    # Encrypted at rest (AES-256-GCM) once keys are managed (Release 2).
+    # Encrypted at rest (AES-256-GCM via app/crypto.py), spec section 43.
     private_key_pem: Mapped[str | None] = mapped_column(Text)
     expiry_date: Mapped[datetime] = mapped_column(DateTime(timezone=True))
     created_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), default=utcnow)
+    # --- Release 2 additions ---
+    is_ca: Mapped[bool] = mapped_column(Boolean, default=False)
+    # CA that signed this certificate (None for self-signed CAs).
+    parent_id: Mapped[uuid.UUID | None] = mapped_column(
+        ForeignKey("certificates.id", ondelete="SET NULL")
+    )
+    key_algorithm: Mapped[str] = mapped_column(String(20), default="ecdsa-p256")
+    serial_number: Mapped[str] = mapped_column(String(64), unique=True, index=True)
+    dns_sans: Mapped[list] = mapped_column(JSON, default=list)
+    ip_sans: Mapped[list] = mapped_column(JSON, default=list)
+    fingerprint: Mapped[str] = mapped_column(String(200), index=True)
+    # issued|expired|revoked — derived/stored at issue time and on expiry checks
+    status: Mapped[str] = mapped_column(String(20), default="issued")
 
 
 # --------------------------------------------------------------------------