🚧 Add CA and server cert management

backend/app/schemas.py

@@ -234,4 +234,48 @@ class RevisionOut(BaseModel):
 
 class RevisionDetailOut(RevisionOut):
     config_text: str
-    validation_result: dict[str, Any]
+    validation_result: dict[str, Any]
+
+
+# --- PKI: certificate authorities + server certificates (spec 16-19) ---------
+
+
+class CaCreate(BaseModel):
+    common_name: str = Field(min_length=1, max_length=200)
+    validity_days: int = Field(gt=0, le=36500)
+    key_algorithm: Literal["rsa3072", "rsa4096", "ecdsa-p256", "ecdsa-p384"]
+    organization: str | None = None
+    organizational_unit: str | None = None
+    country: str | None = Field(default=None, max_length=2)
+
+
+class ServerCertCreate(BaseModel):
+    """Issue a server certificate signed by an existing CA (spec 19)."""
+
+    ca_id: uuid.UUID
+    common_name: str = Field(min_length=1, max_length=200)
+    validity_days: int = Field(gt=0, le=36500)
+    dns_sans: list[str] = Field(default_factory=list)
+    ip_sans: list[str] = Field(default_factory=list)
+    organization: str | None = None
+    organizational_unit: str | None = None
+    country: str | None = Field(default=None, max_length=2)
+
+
+class CertificateOut(BaseModel):
+    """Inventory view — NEVER includes the private key (spec section 21)."""
+
+    id: uuid.UUID
+    common_name: str
+    is_ca: bool
+    parent_id: uuid.UUID | None
+    key_algorithm: str
+    serial_number: str
+    dns_sans: list[str]
+    ip_sans: list[str]
+    fingerprint: str
+    status: str
+    expiry_date: datetime
+    created_at: datetime
+
+    model_config = {"from_attributes": True}