Always pin the server, let the registry own pins, and survive a revoke mid-upgrade

Found in the Windows VM re-test.

- A CA-flagged server certificate (common with a plain openssl self-signed
  cert) produced an installer package with no pin at all, so agent 1.20
  refused the server. The package now always carries the SPKI pin of the
  certificate PCs receive; the CA flag only skips the trusted-root import.
  When an uploaded CA-flagged certificate differs from the server's own, both
  pins are included. The build response carries X-ShopDB-Build-Warning and the
  installer logs what older agents need.
- Pins written into appsettings.json by the installer were merged with the
  registry, so removing a pin from HKLM never took effect. When the ServerPins
  value exists in the registry it is now authoritative, even when empty;
  appsettings pins apply only when it is absent. Set-ShopDBServerPins.ps1
  -Clear deletes the value; new -None writes an empty value (no pins).
- A script or package download sent with a credential revoked moments earlier
  got 401 CREDENTIAL_INVALID and failed the command. The agent now retries that
  download once with the shared key and records the fallback in the result.

plugins/endpoints/frontend/views/AgentKeySettings.vue

@@ -357,8 +357,9 @@
           For a reverse-proxy or internal-CA server this app cannot see, upload
           the server's public certificate in PEM format. It is validated,
           bundled with the package, pinned, and imported into the endpoint's
-          Trusted Root store by <code>install.ps1</code> (a CA certificate is
-          bundled but never imported or pinned). Leave empty when the
+          Trusted Root store by <code>install.ps1</code> (a CA-flagged
+          certificate is bundled and pinned but never imported, so only agents
+          1.20 and newer will trust the server). Leave empty when the
           server uses a publicly trusted certificate. An upload takes precedence
           over the bundled server certificate above.
         </p>
@@ -376,6 +377,7 @@
           </button>
         </div>
         <p v-if="agentmessage" class="field-hint">{{ agentmessage }}</p>
+        <p v-if="agentwarning" class="field-warning">{{ agentwarning }}</p>
         <p v-if="agenterror" class="field-error">{{ agenterror }}</p>
 
         <!-- ================================================================
@@ -603,6 +605,7 @@ const agentcertfile = ref(null)
 const agentbusy = ref(false)
 const agentmessage = ref('')
 const agenterror = ref('')
+const agentwarning = ref('')
 const agentincludesharedkey = ref(true)
 const agentnextserverpin = ref('')
 const agentserverpin = ref('')
@@ -835,6 +838,7 @@ async function buildSiteAgent() {
   agentbusy.value = true
   agentmessage.value = ''
   agenterror.value = ''
+  agentwarning.value = ''
   try {
     const form = new FormData()
     form.append('baseurl', agentbaseurl.value)
@@ -866,6 +870,7 @@ async function buildSiteAgent() {
     link.remove()
     window.URL.revokeObjectURL(url)
     agentmessage.value = 'Site agent built.'
+    agentwarning.value = response.headers?.['x-shopdb-build-warning'] || ''
   } catch (buildError) {
     if (buildError.response?.status === 400 && buildError.response?.data) {
       agenterror.value = await readBlobError(buildError.response.data)