K8s certificate inventory cannot be exported

## Problem

The K8s certificate page tracks certificate expiry — issuer, validity window, days remaining, and status — but the inventory cannot be exported. Operators preparing a security review, compliance audit, or certificate renewal plan currently have to copy certificate rows manually.

Certificate expiry reporting is a routine compliance requirement: auditors and security teams ask for "all certificates and their expiry dates" as a standard deliverable.

## Current behavior and reproduction

1. Open **Cluster > K8s 证书管理**.
2. Use the existing k8s ID/cluster search and type filter to scope the inventory.
3. Try to export the filtered certificate inventory: the page offers create and delete actions, but no export.

`web/src/pages/cluster/certs.tsx` renders `filteredCerts` with search and type filtering, but there is no export control. The existing `GET /api/k8s-certs` list endpoint already returns the complete inventory with all the fields an audit needs: `k8sId`, `cluster`, `type`, `issuer`, `notBefore`, `notAfter`, `daysRemaining`, `status`, and `san`.

## Proposed behavior

- Add an export button to the certificate toolbar that exports the currently filtered certificate inventory (search + type filter), not just the visible page.
- Export the audit-relevant fields: k8s ID, cluster, type, issuer, validity start/end, days remaining, status, and SANs.
- Do not export certificate PEM content or private key PEM — those are secrets; the table does not display them and the export must not leak them.
- Use the shared CSV writer so cells are quoted and spreadsheet formula injection is prevented.
- Show a loading state while the export runs and surface errors instead of failing silently.
- The export can reuse the existing list endpoint; no backend change is required.

## Acceptance criteria

- [ ] The export button requests the certificate inventory with the current search/type filters.
- [ ] Exported columns cover k8s ID, cluster, type, issuer, notBefore, notAfter, daysRemaining, status, and SANs.
- [ ] Certificate PEM and key PEM are never exported.
- [ ] CSV cells are quoted and formula-injection safe via the shared CSV utility.
- [ ] The export shows a loading state and surfaces errors.
- [ ] Regression coverage verifies the filtered request, the downloaded CSV content, and that PEM fields are absent.

## Importance

Should-have. Certificate expiry is a compliance requirement; the current workaround is manual row copying, which is slow and error-prone for inventories with more than a handful of certificates.

## Duplicate check

Searched open and closed issues/PRs for `certificate export`, `cert export`, `k8s cert`, `certificate inventory`. No existing issue or PR adds export to the K8s certificate page.

Start in web/src/pages/cluster/certs.tsx, tracing filteredCerts, the existing search/type filters, and the GET /api/k8s-certs request; then locate the shared CSV writer and nearby export tests. Done means the toolbar exports the filtered inventory with the listed audit fields, excludes PEM values, uses safe CSV cells, shows loading and errors, and has regression coverage for the request and downloaded content.

Written by the indexing model from the issue text.