fix(certs): restore HTTP CA auto-download and test edge matrix

Restore LLM_CA_CERT_URLS support for corporate PKI HTTP cert delivery.
Downloaded certificates are installed into the llm/ CA category and share
the same system trust + NSS import path as CERTS_PATH-mounted certs.

Changes:
- certs.sh: add download_llm_ca_certs with HTTP-only curl policy,
  PEM/DER handling, retries, llm/ storage, hash symlinks for llm+custom
- backend/agent entrypoints: run download before install_all_certs
- compose/env/docs: expose LLM_CA_CERT_URLS again and update ADR-0009
- integration tests: cover PEM/DER/CER, invalid certs, non-HTTP skips,
  query-string filenames, private/server skips, empty inputs, combined
  LLM_CA_CERT_URLS + CERTS_PATH channels, and NSS imports

Verified:
- 194 passed, 1 skipped integration tests
- full backend container smoke passed with testcontainers PostgreSQL
- docker bundle rebuilt for 0.5.0

docker-compose.yml

@@ -37,6 +37,7 @@ services:
       INITIAL_ADMIN_PASSWORD: ${INITIAL_ADMIN_PASSWORD:-}
       FEATURES__DATASET_REVIEW: ${FEATURES__DATASET_REVIEW:-true}
       FEATURES__HEALTH_MONITOR: ${FEATURES__HEALTH_MONITOR:-true}
+      LLM_CA_CERT_URLS: ${LLM_CA_CERT_URLS:-}
     ports:
       - "${BACKEND_HOST_PORT:-8001}:8000"
     volumes:
@@ -62,6 +63,7 @@ services:
       SERVICE_JWT: ${SERVICE_JWT:-agent-service-secret}
       DATABASE_URL: postgresql+psycopg2://postgres:postgres@db:5432/ss_tools
       GRADIO_SERVER_PORT: 7860
+      LLM_CA_CERT_URLS: ${LLM_CA_CERT_URLS:-}
     ports:
       - "7860"  # internal only, proxied through nginx
     volumes: