Implement CA Key Rotation Scheduler

Create scheduled task for automatic CA rotation every 90 days with 2-hour overlap, promote next key to current, generate new next key

Locate the CA key management and scheduling entry points in the Go repository, then read how current and next keys are stored and promoted. Define the rotation flow around the 90-day interval and two-hour overlap. Done means a scheduled task promotes the next key, generates a replacement next key, and preserves the overlap behavior.

Written by the indexing model from the issue text.