fix(certs): restore HTTP CA auto-download and test edge matrix

Restore LLM_CA_CERT_URLS support for corporate PKI HTTP cert delivery.
Downloaded certificates are installed into the llm/ CA category and share
the same system trust + NSS import path as CERTS_PATH-mounted certs.

Changes:
- certs.sh: add download_llm_ca_certs with HTTP-only curl policy,
  PEM/DER handling, retries, llm/ storage, hash symlinks for llm+custom
- backend/agent entrypoints: run download before install_all_certs
- compose/env/docs: expose LLM_CA_CERT_URLS again and update ADR-0009
- integration tests: cover PEM/DER/CER, invalid certs, non-HTTP skips,
  query-string filenames, private/server skips, empty inputs, combined
  LLM_CA_CERT_URLS + CERTS_PATH channels, and NSS imports

Verified:
- 194 passed, 1 skipped integration tests
- full backend container smoke passed with testcontainers PostgreSQL
- docker bundle rebuilt for 0.5.0

docker-compose.enterprise-clean.yml

@@ -54,6 +54,7 @@ services:
       ANTHROPIC_API_KEY: ${ANTHROPIC_API_KEY:-}
       FEATURES__DATASET_REVIEW: ${FEATURES__DATASET_REVIEW:-true}
       FEATURES__HEALTH_MONITOR: ${FEATURES__HEALTH_MONITOR:-true}
+      LLM_CA_CERT_URLS: ${LLM_CA_CERT_URLS:-}
       # Путь до сертификатов внутри контейнера — всегда /opt/certs
       CERTS_PATH: /opt/certs
     ports:
@@ -103,6 +104,7 @@ services:
       SERVICE_JWT: ${SERVICE_JWT:-agent-service-secret}
       DATABASE_URL: postgresql+psycopg2://${POSTGRES_USER:-postgres}:${POSTGRES_PASSWORD:?Set POSTGRES_PASSWORD in .env.enterprise-clean}@${POSTGRES_HOST:?Set POSTGRES_HOST in .env.enterprise-clean}:${POSTGRES_PORT:-5432}/${POSTGRES_DB:-ss_tools}
       GRADIO_SERVER_PORT: 7860
+      LLM_CA_CERT_URLS: ${LLM_CA_CERT_URLS:-}
     ports:
       - "${AGENT_HOST_PORT:-7860}:7860"
     volumes: