CA public key in OpenSSH format endpoint

The service exposes CA public keys in JWK format via `GET /api/v1/jwks`, which is useful for programmatic verification. But when an HPC admin sets up a login node to trust the signer's CA, they need the key in OpenSSH `authorized_keys` format for `sshd_config`'s `TrustedUserCAKeys` directive. Converting between formats manually is error-prone.

- Add `GET /api/v1/ca-public-key` returning the current CA public key as ` `
- Also return the `next` key if one exists, so admins can pre-trust it before a CA rotation
- Requires client authentication (same as the JWKS endpoint)
- With this, onboarding a new login node is as simple as: `curl ... /api/v1/ca-public-key >> /etc/ssh/trusted_cas`

Start by reading the existing GET /api/v1/jwks endpoint and its client-authentication path. Add GET /api/v1/ca-public-key with the current CA key and any next key in OpenSSH authorized_keys format; done means the endpoint supports the described curl-based TrustedUserCAKeys onboarding flow.

Written by the indexing model from the issue text.