Add server certificate management documentation and regeneration scripts

Documentation:
- certs/README.md: Complete guide for managing nginx TLS certificates
- Server cert generation (self-signed, CA-signed, Let's Encrypt)
- Certificate expiry monitoring and renewal procedures
- Agent certificate pinning configuration
- Air-gapped deployment notes

Tooling:
- certs/regenerate-server-cert.sh: Bash script for cert regeneration
- certs/regenerate-server-cert.ps1: PowerShell script for Windows
- Both scripts backup old certs and display new thumbprint

Config:
- Updated .gitignore to allow cert management files (docs/scripts/config)
- Private keys and actual certificates still excluded (security)

Context:
- User asked where to manage server-side certificate
- Current cert: self-signed, CN=localhost, valid 1 year
- Agents validate server cert via pinning or Windows trusted roots
- Critical for mTLS client cert authentication (ADR-006)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

certs/regenerate-server-cert.sh

@@ -0,0 +1,52 @@
+#!/bin/bash
+# Regenerate self-signed server certificate for ShopDB nginx
+# Run this script from the repository root: bash certs/regenerate-server-cert.sh
+
+set -e
+
+CERT_DIR="certs"
+DAYS_VALID=365
+
+echo "=== ShopDB Server Certificate Generator ==="
+echo ""
+
+# Check if running from repo root
+if [ ! -f "docker-compose.yml" ]; then
+    echo "ERROR: Must run from repository root"
+    echo "Usage: bash certs/regenerate-server-cert.sh"
+    exit 1
+fi
+
+# Backup old certificate
+if [ -f "$CERT_DIR/server.crt" ]; then
+    echo "Backing up existing certificate..."
+    cp "$CERT_DIR/server.crt" "$CERT_DIR/server.crt.backup"
+    cp "$CERT_DIR/server.key" "$CERT_DIR/server.key.backup"
+    OLD_EXPIRY=$(openssl x509 -in "$CERT_DIR/server.crt" -noout -enddate)
+    echo "  Old certificate: $OLD_EXPIRY"
+fi
+
+# Generate new certificate
+echo ""
+echo "Generating new self-signed certificate (valid $DAYS_VALID days)..."
+openssl req -x509 -newkey rsa:2048 -nodes \
+  -keyout "$CERT_DIR/server.key" \
+  -out "$CERT_DIR/server.crt" \
+  -days $DAYS_VALID \
+  -config "$CERT_DIR/openssl.cnf" 2>/dev/null
+
+echo ""
+echo "Certificate generated successfully!"
+echo ""
+
+# Show certificate details
+echo "=== Certificate Details ==="
+openssl x509 -in "$CERT_DIR/server.crt" -noout -subject -dates -fingerprint -sha256
+
+echo ""
+echo "=== Next Steps ==="
+echo "1. Restart nginx: docker-compose restart nginx"
+echo "2. If agents use ServerCertThumbprint pinning:"
+echo "   - Update appsettings.json with new thumbprint (shown above)"
+echo "   - Restart all agents BEFORE old certificate expires"
+echo ""