Crypto hygiene: increase CA serial entropy to 128 bits

**Severity:** Low (defense-in-depth)
**Files:** `serials.go`

`certSerial()` uses `rand.Int(rand.Reader, big.NewInt(9223372036854))` — only ~42 bits of entropy. RFC 5280 recommends ≥64 bits, and CA/Browser Forum BR mandates 64-bit unpredictable serials. The constant also appears to be a copy-paste truncation of int64 max.

### Remediation
```go
max := new(big.Int).Lsh(big.NewInt(1), 127) // 128 bits
serNum, err := rand.Int(rand.Reader, max)
```

**Refs:** CWE-330, RFC 5280 §4.1.2.2.

Start in serials.go at certSerial() and inspect how the serial-number bound is constructed and passed to crypto/rand.Int. Update the bound to provide 128 bits of entropy, then run the repository's Go tests and confirm generated serials still produce valid certificates.

Written by the indexing model from the issue text.