[FEATURE] Backup and export mechanism for Root CA and generated certificates (PKI backup support)

Is your feature request related to a problem? Please describe.

LibreSign currently stores the Root CA and all generated certificates inside the Nextcloud appdata directory.

In production environments, these certificates represent legally binding digital signatures and form the trust chain of signed documents.

However:

• There is no built-in way to export or back up the Root CA.
• There is no official mechanism to back up the PKI structure.
• Accidental deletion, corruption, migration, or update issues could permanently break the trust chain.
• Regenerating a Root CA after loss would invalidate the long-term consistency of signatures and CRLs.
• This creates a significant operational and legal risk in production environments.

Describe the solution you'd like

I would like LibreSign to provide an official and secure backup/export mechanism for:

1. Root CA private key and certificate
2. Full PKI directory (index, serial, CRL, etc.)
3. Generated user certificates
4. CRL data
5. OpenSSL configuration used for the CA

Ideally, this could include:

• A downloadable encrypted backup archive from the admin interface
• A CLI command (e.g. occ libresign:backup)
• Optional encryption with a passphrase
• A restore command (e.g. occ libresign:restore)
• Clear documentation on backup strategy for production

This would allow administrators to:

• Implement disaster recovery plans
• Securely store PKI off-server
• Maintain long-term signature validity
• Avoid catastrophic trust chain loss

Describe alternatives you've considered

Currently, the only workaround is to manually:

• Identify the PKI directory inside appdata
• Manually back up the entire directory via filesystem
• Manually restore it if needed

This approach is:

• Not officially documented
• Error-prone
• Risky for non-expert administrators
• Potentially incompatible with future structural changes

Additionally, relying solely on filesystem backups does not provide a clear or supported recovery path.

Additional context

In production use cases where LibreSign is used for contractual signatures:

• The Root CA must be preserved long-term
• The CRL must remain consistent
• Trust continuity must be guaranteed

An official backup/restore mechanism would significantly increase confidence in LibreSign for enterprise and compliance-sensitive environments.

This feature would help position LibreSign as a production-grade digital signature solution suitable for legal and contractual workflows.

If useful, I would be happy to help test or provide feedback on a backup/export implementation.

Start by examining how LibreSign stores the Root CA, generated certificates, CRL data, and OpenSSL configuration in the Nextcloud appdata directory. Then review the admin interface and proposed occ libresign:backup and occ libresign:restore entry points. Done means defining a secure, documented backup and recovery path that preserves the complete PKI trust chain.