fix TLS: proper CA + server cert chain, CT trust flags

Firefox rejected the self-signed cert because:
1. The issuer was a wildcard CN (not a valid CA)
2. Trust flags were C,, (not CT,,)

Now generates a proper chain:
- ca.crt/ca.key — CA with CN="Homelab CA, O=fhirworx"
- homelab.crt/key — server cert signed by CA with SAN wildcard

install_certs.sh updated to import ca.crt with CT,, flags.

dev/scripts/install_certs.sh

@@ -5,7 +5,8 @@
 # Usage: ./dev/scripts/install_certs.sh
 
 set -uo pipefail
-CERT="$(cd "$(dirname "$0")/../.." && pwd)/traefik/certs/homelab.crt"
+CERT="$(cd "$(dirname "$0")/../.." && pwd)/traefik/certs/ca.crt"
+CERT_NAME="Homelab CA"
 
 if [ ! -f "$CERT" ]; then
   echo "ERROR: $CERT not found. Run from the project root."
@@ -27,7 +28,7 @@ if command -v certutil &>/dev/null; then
   find "$HOME/.mozilla/firefox" "$HOME/.config/mozilla/firefox" -name "cert9.db" -printf '%h\n' 2>/dev/null | sort -u | while read -r dir; do
     profile="$(basename "$dir")"
     echo "    profile: $profile"
-    certutil -d "sql:$dir" -A -t "C,," -n "homelab-fhirworx" -i "$CERT" 2>/dev/null || true
+    certutil -d "sql:$dir" -A -t "CT,," -n "$CERT_NAME" -i "$CERT" 2>/dev/null || true
   done
 else
   echo "  ⚠ certutil not found — install libnss3-tools for Firefox cert import"
@@ -38,7 +39,7 @@ fi
 NSS_DB="$HOME/.pki/nssdb"
 if [ -d "$NSS_DB" ] && command -v certutil &>/dev/null; then
   echo "  → Chromium/Chrome ($NSS_DB)"
-  certutil -d "sql:$NSS_DB" -A -t "C,," -n "homelab-fhirworx" -i "$CERT" 2>/dev/null || true
+  certutil -d "sql:$NSS_DB" -A -t "CT,," -n "$CERT_NAME" -i "$CERT" 2>/dev/null || true
 fi
 
 # ── Node.js (for Docusaurus builds) ──────────────────────────

traefik/certs/ca.crt

@@ -0,0 +1,20 @@
+-----BEGIN CERTIFICATE-----
+MIIDMTCCAhmgAwIBAgIURQevAWH0MWQtBXf/hV8VNsANXk4wDQYJKoZIhvcNAQEL
+BQAwKDETMBEGA1UEAwwKSG9tZWxhYiBDQTERMA8GA1UECgwIZmhpcndvcngwHhcN
+MjYwMzIxMjAzMDI5WhcNMzYwMzE4MjAzMDI5WjAoMRMwEQYDVQQDDApIb21lbGFi
+IENBMREwDwYDVQQKDAhmaGlyd29yeDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC
+AQoCggEBAMJ8lfw2IQe7sIU8SykD0EwSN9uMOxd9DLkZPfaP/N9CSRvK01smwsdo
+Nr2riPi+Ng+ufjxOVbe7QlhwSTFK9gR8+/IT7iTJT7vD8EfR6Ud2qSJLcvJDfhUQ
+Dc5N9oBueC4XJ3Ohad6cHL/tOdH9/D0zwjbdkUd9+iPvDv9VaPf7PH3jiBpcgEKI
+gLy+noySFFAY8HWu5c33EhiepgXBiXRDAQDighpodcRxHBkDFdRMTQnAjQK2/BQ/
+si74JTC+GpHvEiDCBTQ+L6BUdPI5aP3mUZ/LCqIiyGFSzbshQ9MWdOa0QWEdyKOy
+42+aZaH/FLJ4a6ToGx5I1ZmGNyPiHQUCAwEAAaNTMFEwHQYDVR0OBBYEFGDEf48T
+ZywSgSib037Mty2VaXOuMB8GA1UdIwQYMBaAFGDEf48TZywSgSib037Mty2VaXOu
+MA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAA/vF6bk0MgB5hvW
+YS90Utf0Njh1ZqSw/qdu2Pdqfc05qInfcL7c8I/77yl8tX6+gd/vDQ3DekHxI0vO
+SDZMyhW3uglIQMnd+LaXEZATFFuV8PWwXIJ5KgWhUJ6qJbJwO9LT+YnP3XohaHRW
+oayHGR/h0oJPKJu41ZH5BSMfvIFNCN7x7x7a9cjL0Todu35+vgwsoKjI/fm6dbh4
+T83eZDhYYxaWJrTYdagMKOpxThVHcooITGifnajelTe+NpH8LOSaszOI2WZqFocN
+qRG1WQt9TIRqIG4stnSsQ/0bG/Woh4SNd2CkLY2hsKOCJMi+Xbss/PCPew+RwRGW
+XQQaUuk=
+-----END CERTIFICATE-----

traefik/certs/ca.key

@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDCfJX8NiEHu7CF
+PEspA9BMEjfbjDsXfQy5GT32j/zfQkkbytNbJsLHaDa9q4j4vjYPrn48TlW3u0JY
+cEkxSvYEfPvyE+4kyU+7w/BH0elHdqkiS3LyQ34VEA3OTfaAbnguFydzoWnenBy/
+7TnR/fw9M8I23ZFHffoj7w7/VWj3+zx944gaXIBCiIC8vp6MkhRQGPB1ruXN9xIY
+nqYFwYl0QwEA4oIaaHXEcRwZAxXUTE0JwI0CtvwUP7Iu+CUwvhqR7xIgwgU0Pi+g
+VHTyOWj95lGfywqiIshhUs27IUPTFnTmtEFhHcijsuNvmmWh/xSyeGuk6BseSNWZ
+hjcj4h0FAgMBAAECggEAAqjw+QtqjZPtP5AD8iQtic0dmeFijIL6r/izqGvgJI6z
+0LGqltmJsI1zil2V3FsOtAigIGYPVbciEMHGYxuawVkTGjXr6rZh52vNmFAFPbJg
+XQAxXAQkVQ6bP5PyRsJIVTtZpRHOS6lL0NN6+plbnb5I9XaQRIDVopxfEpS6mQuh
+N/vHBnFBdQp+0dj2/MnBdOFjEBhqaCcUVs9WPbO8E6fVDcav3rioHH87Nhbyv8tK
+2995yhWQ32gxevRId+Dp7ZWslksTEYukqJ2v065xaz0HiT1tZo7xEkkEkl40Ve0h
+gPH+StXs6xvNxSVQ13WmwyO2UM72ZZ7+cnW9VDk4aQKBgQD2eQP6JiiTFzgzAeYu
+Updj0Ti15VRtNXwppwVl+WiD7R4NdHrH8nj4kPA+Pqpg2Pu4RJqGhxo3nEojibaG
+hYWUbqc6pqY9DjX6All2f7Xxw8sBrvwXBduDMuYRTJlOZML0kq9JSUT9YV8BvTmj
+SNUijLkMEa7ZOUem6CFnhXxeGQKBgQDKASOz9xPcyF/Tp4pazKXBQh/EB55Dru6P
+eY/avSiGiica40QnibMsnYESHaOWnD/pYPlebZqX/4A0IuvC3LhOrMtucpvq3B/6
+RJy1oeWro7hkDHUFa9XsQNwLQ+msLbdp1MUd6I9kGw2g9GD4s0lrpBDfdkwvsizb
+E8m/H9M7zQKBgDoRKK62bri4r7TUrbYcHy6VDBdOgCV6hFYL02nC6KysIHhrCMIy
+je2BuBfyC5HljOhMwVsQWUzgtVbKCwaGToI5z4wx1thrkKvmAc25KNRcnGc5IosK
+Bj1SsIFC2pttgcC9Di7l5CsN1aRDQGEHt678GFyPjfH/XLIl3jjVageBAoGBAKMf
+DG+1I8rz274U2vq7q1ZGSVSJOlo5ltcxOONQQLt0MGPcBhtPbOqoPaQdXw6uGkYh
+Uv3X0DDR1/tB/9QZXJPboWMNFa8wFnqIkWty0v4pdSsFjDHWhKcFMSu/qaCqQiQp
+9wtR0wjpd7Xz4aKzVKShliZ9ZsRVQzed4Rp/Xpo5AoGBAK80yz5I17KG8p9ZPo0f
+tCBtmM9txRTdcZTUTpbEF4/9se7+jyDFCKPhGj7JzRtAxdqt39cZmzE7HAezwM+K
+OhT3nNQdqjQCZyvjSE8Ac/hefpoFsSPggZoBw1pRJol/kstILuwDrq3QkqDy/fnZ
+jpPYp7yGIN5t+/mLOeB1H53A
+-----END PRIVATE KEY-----

traefik/certs/homelab.crt

@@ -1,20 +1,20 @@
 -----BEGIN CERTIFICATE-----
-MIIDWjCCAkKgAwIBAgIUKMP/c0vrAZp+UTKNAu4cUYUzl64wDQYJKoZIhvcNAQEL
+MIIDTzCCAjegAwIBAgIUA6ONmnapagAZEkVJMOs50qjWmNcwDQYJKoZIhvcNAQEL
-BQAwIDEeMBwGA1UEAwwVKi5ob21lbGFiLmZoaXJ3b3J4LmlvMB4XDTI2MDMyMTIw
+BQAwKDETMBEGA1UEAwwKSG9tZWxhYiBDQTERMA8GA1UECgwIZmhpcndvcngwHhcN
-MjAwN1oXDTM2MDMxODIwMjAwN1owIDEeMBwGA1UEAwwVKi5ob21lbGFiLmZoaXJ3
+MjYwMzIxMjAzMDI5WhcNMzYwMzE4MjAzMDI5WjAgMR4wHAYDVQQDDBUqLmhvbWVs
-b3J4LmlvMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA19ujW/VKqeqY
+YWIuZmhpcndvcnguaW8wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDk
-jBbjcKa2jUSz5VY+3H3R0G1si2e9x9tICgy2bC738YYTphl1ScjPBQJtFkjJEmcg
+yZZrB/IUL2E/BgEXM8uRMgV9P59wuz+m4FIZL4Zr6jUdVX0gyqchDxipyq3EoOHM
-CeIGNBXM03mGgfagb7VhPN8KdRrOKu4x/FCmCeRjit1haMniQRIdo5VfbQRvzH30
+Eg4OHK75z/rrhIFqesXg+GML3qd8s+t8LJ9d2BDd2mvr4pQXf9jvBFd+rxJr8thA
-zik5pAmezizEOfSrQlU26u3pGga30YaZoKd32/WJ2JDo80sNWfAZd7jDx/ND97bw
+lyjDkRWtpnaX3jRS5U0YcxXXMzji6+ENYkFyM2J3km9tEloj1hv69gFVCM79XjYf
-T1KM9aK/JCjEQkuvtScUX4YbQylWYye5fikRpEgyqRN98i1a3eFgTbd+yWFTTSPg
+Id2pLcIKkU4zv+kZ9VesWsQs4BBKArlyCNOO4/emn8h6ezo6w501AKeold9cRt7N
-29/FaCAe+LKHCcFo2jaNtSLk9bK9fGyCKkjaRhVWgHChHQ8uzO9yzRM4g81u7YdN
+pUXA9a5eR+XjAzyAc0nMeoDZ7CCnyUwxHZMMyeNuxgi8BHq92cL4b2G7CQKKlqvP
-Oa0lZs9LpQIDAQABo4GLMIGIMB0GA1UdDgQWBBSgCqYJcKDdr6kp6Ltf7GBGLNB7
+349uzPo8TBeetr/VVlhJAgMBAAGjeTB3MDUGA1UdEQQuMCyCFSouaG9tZWxhYi5m
-xTAfBgNVHSMEGDAWgBSgCqYJcKDdr6kp6Ltf7GBGLNB7xTAPBgNVHRMBAf8EBTAD
+aGlyd29yeC5pb4ITaG9tZWxhYi5maGlyd29yeC5pbzAdBgNVHQ4EFgQUjnPOWk81
-AQH/MDUGA1UdEQQuMCyCFSouaG9tZWxhYi5maGlyd29yeC5pb4ITaG9tZWxhYi5m
+NtrM9ES2ch+uUtpb178wHwYDVR0jBBgwFoAUYMR/jxNnLBKBKJvTfsy3LZVpc64w
-aGlyd29yeC5pbzANBgkqhkiG9w0BAQsFAAOCAQEAb1OzTg2sRJTOmhgL/QSDiud+
+DQYJKoZIhvcNAQELBQADggEBAGavs2drAc+a7B4hGuIOwaRgIUmqjoIipXJHXwQt
-nDVCSRy9PzZzU8uoxruA68Pgnc21HnEwfd7vHGR58uE4ZNaRWz1LqX78BN8u3Xbx
+5ZsLoBOR7ybqKfYidwnYqvfSdbVFlE/vu+81nTAFe+2TmndaZ7IndeVojOWoSvie
-ZiS8zZAg+z+Xwxi6iNk9CFRVq+vUah/Fdm4bolGpUtKIaO79gxeNB+px16mFokAu
+ritNiTjrOhjTX35QJ/OIfux0kVNWYqwMJNkhK6OKe7NOcGpev9nPp9xKDI9yYIHp
-biTIxwaFXSL/PnKLNCdILcH/iSmvYxSyZVPl7sI9cepyevu8yqZfvQzhOAt1G0mB
+VMOEKTbhxBk+dBjkn8FyzTyRersTqFxqNtCBrMsCoDNWvNsWIVStw26QTfnkJ36r
-gbkkyNYJKZ3nnrpL4IxOdooD64kn0D3Bc3GDnWBE8gYTI7JW2Upv/LqIvP0NNUxn
+dG3ar1doUBxykjHUigOLC+JAOVQSVaWj2ZSz6nPTITnCGzZyc+OWzHtPnFF8kY2O
-SShTkrTUVLu+/Dpzcj+gtaXV218s+/TORpndGOArtszF3ZK7cQba+M+R7bX55g==
+dOc+Ob2Kyy5ZJvYrmoXBp0qg42VbP0qOgzjpN4lfd2hkZeU=
 -----END CERTIFICATE-----

traefik/certs/homelab.key

@@ -1,28 +1,28 @@
 -----BEGIN PRIVATE KEY-----
-MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDX26Nb9Uqp6piM
+MIIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQDkyZZrB/IUL2E/
-FuNwpraNRLPlVj7cfdHQbWyLZ73H20gKDLZsLvfxhhOmGXVJyM8FAm0WSMkSZyAJ
+BgEXM8uRMgV9P59wuz+m4FIZL4Zr6jUdVX0gyqchDxipyq3EoOHMEg4OHK75z/rr
-4gY0FczTeYaB9qBvtWE83wp1Gs4q7jH8UKYJ5GOK3WFoyeJBEh2jlV9tBG/MffTO
+hIFqesXg+GML3qd8s+t8LJ9d2BDd2mvr4pQXf9jvBFd+rxJr8thAlyjDkRWtpnaX
-KTmkCZ7OLMQ59KtCVTbq7ekaBrfRhpmgp3fb9YnYkOjzSw1Z8Bl3uMPH80P3tvBP
+3jRS5U0YcxXXMzji6+ENYkFyM2J3km9tEloj1hv69gFVCM79XjYfId2pLcIKkU4z
-Uoz1or8kKMRCS6+1JxRfhhtDKVZjJ7l+KRGkSDKpE33yLVrd4WBNt37JYVNNI+Db
+v+kZ9VesWsQs4BBKArlyCNOO4/emn8h6ezo6w501AKeold9cRt7NpUXA9a5eR+Xj
-38VoIB74socJwWjaNo21IuT1sr18bIIqSNpGFVaAcKEdDy7M73LNEziDzW7th005
+AzyAc0nMeoDZ7CCnyUwxHZMMyeNuxgi8BHq92cL4b2G7CQKKlqvP349uzPo8TBee
-rSVmz0ulAgMBAAECggEAE1KylEW1IHI2cK5cP6MOfj8gGYLeD4MZEd7rYHlYPriH
+tr/VVlhJAgMBAAECggEAQAo/XPFJ7SWAAnyjRIPeiONoDvGGpy76t7LVuDAJ394c
-Aa5/2aReU4BTAin1dJyL+uDr0gEqNFvUVuSLjwSqkf3ArqHcwwZwhQn0V8vr/vs7
+hPv/fPTMyF+p5ykQ79earJ0nKwMTZWC2m0MpWI1KI1lTnCh0WF8iXM0+xK1stzTi
-fa12ITZd1AcB55o27YGvjIuPf/6HLlee+NUtt0NmZ2kQS2qqUAuGMunUPAO0JDna
+/ZGcI2HJbsoX1aGatfWxW48UPX24hDVyv7rWiZeet2fLZsPzOe2NvsnQiO9iMhaX
-joLEm0fgWkiJXq7V8pEg3bn8GSWiMxnZeA6EYJT1CG90tDpLUc4f4qPvjWVetW4m
+MmQMmRJP/0XowQwELyms3HjZw4XTP2jj6DuuHBVmx5XSCrb0yVjeJmQDI4aArnru
-vlq0cB6JoE3cB5woQSaR/aCHX0D3Pbhz7UiIcmstQ6mwe5hnogO6VmsRAVjOIrph
+GaW7zo4sRrGQCGbiVV451JyTEP5NQsOKVrPOuW9fn+2f2m7Xf9j3wqu85BPaIij8
-Qn7qpI4yKxKezOMIM1Dh2EGYVgVhlP8wN1pzX/1A+wKBgQD0qgMn/PxAAHE00B16
+EdHYIp7yxgHWc/k4IGdaNEsLnnfMZDZN0AeTQtY/awKBgQD14/+AQbmnXY0zAq05
-dGj25BYc/ih5r19TXAp6hgJfFWaWL60ESrFNGXKAxa67/PJoWGth8ev842zqkfj9
+d2k6UW2sLWBZelVv0ncc2L+WFNxYqpUBecB4NQhZ8O3EB7r8pI9f2wA3ZAJXkSWS
-Yg5S09yceyXnBFjJnjSkuY8QK0ZLEZKHcK8UosWR1Y/bBOS+JL5raQLdC4vDlWiz
+/gbMEzsXu3DUIRisKSNVoWsgi79KjwZkZtTFveNwwHwawNfJd7afymNKJ11BYw4F
-DQTiUeroAK1v3jjxS0K8C8elWwKBgQDh2/PyeFniXyXFaGFa/6Unv+JwDdh8Sk3A
+LM2PCGzDgDbLi3UA85bIuU1ZNwKBgQDuMZQW+++24vogm9lEjZXddL5wpz5UY1MF
-rMicBDJ8WgSpiHoGupQTTFDMkMl0EJ4mR3Bjvzvh5tGyBvKLxuLdU/lBOUAOr3uC
+1iEnTSQ3bdt2zFUK8Zan0aLAgGquqdGtM/lpPFo2lksa1Q/thom2LhOF2q99Jn09
-cK5LWNeqibpNODBqT5tP33RBJHtiQPrq5wkozXmUyG1XxHXP7iz4tobsG/JW+FZb
+gSitzF2Sne1c59dT36dIMb4dIyH/KPxDCZUFJt9Rf6s/5+W4fvwzXtSL7TMDHZ/u
-ZshxGEqi/wKBgQDSds1wQLfddoProns5M5p3h41eM2QuCSY/VxXMgCraEFbHKwvy
+Nv+u2BSafwKBgBhU0FKLrmhOTIuQpz15gHMh3Z1c/By+ize+dsTm+cZLGCa58nar
-fS433IQbMfI11EnSaP02rB0M1baDsj41+XvI1GcaVPUt3RdjmKxAZz8h8ZfuS5d4
+6oy6irIDsjNkpG8dhYZxsErK3aR2m2Y5Nsj42i8WACstfziB9Zoil+wnh+1Dy9kh
-2v5BCiRaZxPwnC0JRCJp01ObQqtf+86s964T4dPo72xCpy7kopEtohSDsQKBgQCo
+h8ptaNUeZulqza+E5hBXwY1z6blvqNKARXLy3XhW9pUbnp9Se0gvdeTvAoGARwHO
-r3EkD/T52BxKsum7YCHGbU6+Z+je81Pc6m8t7wiRzV2cDP0uV11OiHn0PtLm555m
+pN9sAbg+WpQ7O919bKxNzWV+BkgpytafwYiUoFWGlC6rt3x3rgWnn/1oUDNdx2V0
-coajSOl9j7nf38Z41MMNkLEhoJOSJEf3pRbX2XPBv/mvwJ6QWAJkhjy6hnfMa0G7
+F7QfLKC3OQOFIQj3arDnrwKXSBa+RSSIzO7cgkXEKesPXPiSdMonY6ZCjz9XnGBx
-/W/e1I/QqlzX5zgiYv2diB1+7GRzxighPcPIi976mwKBgAmFsr+8G9Rtz891Em+w
+5TxGXJRTp9RovgxVALdnY2NNzsL5F1mb9TKDSd8CgYBKl/cyqUQ/f9MiMdKYgnmb
-D8dPFAdZYBg9aSSYjJd7+22l5CWf40DYcdlU34JfK3mT8s17UMGfBYJnA8IHLfJ9
+t0MfoAbma5kXgvD0hlXbZU+bSm9eMl1LjrieKO7kxtdTrROrArqPbQelRrdulx+o
-cHn9y6HInuxs1bydNplRCGJjLNBWTyXNZeCUNAosn9vSM7r6/TAidtQHEupWmniE
+o4A4JWgJoY+g6TlSId3pX0bIvW+Wqp/ym97mN5tGCW0o2BwS/5S8ehRPcWyaO7zO
-K3vJ+OiqlumDDbQ1A12tf4EW
+QtWyxoW/UNn95YJceRp7xg==
 -----END PRIVATE KEY-----