fscert variant crashes on chart-generated self-signed key (PKCS#1 vs PKCS#8 mismatch)

## Objective

The `fscert` image variant crashes at startup when using the chart's `fallbackSecret.generatedCertificate` self-signed certificate, because Helm's `genSelfSignedCert` produces a PKCS#1 RSA private key (`BEGIN RSA PRIVATE KEY`) while the app's signing-key parser only accepts PKCS#8 (`BEGIN PRIVATE KEY`). Make the app's signing-key parser accept both PKCS#1 and PKCS#8 formats so the self-signed certificate path works.

## Deliverables

- Update `src/utils/cert_manager/strategy.rs` `normalize_pkcs8_key` (and any related key-loading path) to detect and convert PKCS#1 RSA PEM keys (`BEGIN RSA PRIVATE KEY`) to PKCS#8, in addition to the existing PKCS#8 support.
- Unit tests covering PKCS#1 RSA PEM, PKCS#8 PEM, and PKCS#8 DER signing keys.
- Update the chart's `fallbackSecret.generatedCertificate` documentation/behavior if needed to note the supported key formats.

## Acceptance Criteria

- [ ] The `fscert` variant starts successfully when using the chart's `fallbackSecret.generatedCertificate` self-signed certificate (no `Failed to parse key` crash).
- [ ] `normalize_pkcs8_key` accepts a PKCS#1 RSA PEM key (`BEGIN RSA PRIVATE KEY`) and returns a valid PKCS#8 PEM.
- [ ] `normalize_pkcs8_key` continues to accept PKCS#8 PEM and PKCS#8 DER keys.
- [ ] New unit tests pass (`cargo test --lib utils::cert_manager::strategy`).
- [ ] A local deployment using the `fscert` variant + `values-local.yaml` reaches `1/1 Running` and `/health/ready` returns `READY`.

## Dependencies

_None_