Add server certificate management documentation and regeneration scripts

Documentation:
- certs/README.md: Complete guide for managing nginx TLS certificates
- Server cert generation (self-signed, CA-signed, Let's Encrypt)
- Certificate expiry monitoring and renewal procedures
- Agent certificate pinning configuration
- Air-gapped deployment notes

Tooling:
- certs/regenerate-server-cert.sh: Bash script for cert regeneration
- certs/regenerate-server-cert.ps1: PowerShell script for Windows
- Both scripts backup old certs and display new thumbprint

Config:
- Updated .gitignore to allow cert management files (docs/scripts/config)
- Private keys and actual certificates still excluded (security)

Context:
- User asked where to manage server-side certificate
- Current cert: self-signed, CN=localhost, valid 1 year
- Agents validate server cert via pinning or Windows trusted roots
- Critical for mTLS client cert authentication (ADR-006)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

certs/regenerate-server-cert.ps1

@@ -0,0 +1,53 @@
+# Regenerate self-signed server certificate for ShopDB nginx
+# Run from repository root: .\certs\regenerate-server-cert.ps1
+
+$ErrorActionPreference = "Stop"
+
+$CertDir = "certs"
+$DaysValid = 365
+
+Write-Host "=== ShopDB Server Certificate Generator ===" -ForegroundColor Cyan
+Write-Host ""
+
+# Check if running from repo root
+if (-not (Test-Path "docker-compose.yml")) {
+    Write-Host "ERROR: Must run from repository root" -ForegroundColor Red
+    Write-Host "Usage: .\certs\regenerate-server-cert.ps1"
+    exit 1
+}
+
+# Backup old certificate
+if (Test-Path "$CertDir\server.crt") {
+    Write-Host "Backing up existing certificate..."
+    Copy-Item "$CertDir\server.crt" "$CertDir\server.crt.backup" -Force
+    Copy-Item "$CertDir\server.key" "$CertDir\server.key.backup" -Force
+
+    $oldExpiry = openssl x509 -in "$CertDir\server.crt" -noout -enddate 2>$null
+    Write-Host "  Old certificate: $oldExpiry"
+}
+
+# Generate new certificate
+Write-Host ""
+Write-Host "Generating new self-signed certificate (valid $DaysValid days)..." -ForegroundColor Yellow
+
+openssl req -x509 -newkey rsa:2048 -nodes `
+  -keyout "$CertDir\server.key" `
+  -out "$CertDir\server.crt" `
+  -days $DaysValid `
+  -config "$CertDir\openssl.cnf" 2>$null
+
+Write-Host ""
+Write-Host "Certificate generated successfully!" -ForegroundColor Green
+Write-Host ""
+
+# Show certificate details
+Write-Host "=== Certificate Details ===" -ForegroundColor Cyan
+openssl x509 -in "$CertDir\server.crt" -noout -subject -dates -fingerprint -sha256
+
+Write-Host ""
+Write-Host "=== Next Steps ===" -ForegroundColor Yellow
+Write-Host "1. Restart nginx: docker-compose restart nginx"
+Write-Host "2. If agents use ServerCertThumbprint pinning:"
+Write-Host "   - Update appsettings.json with new thumbprint (shown above)"
+Write-Host "   - Restart all agents BEFORE old certificate expires"
+Write-Host ""