feat(ssl): add passphrase-protected key and PKCS#12 support in nginx entrypoint

- docker/frontend.entrypoint.sh: add 3 new functions:
  - extract_p12_if_needed — openssl pkcs12 extraction to .crt+.key
  - resolve_ssl_passphrase — read SSL_KEY_PASSPHRASE env var
  - decrypt_key_if_needed — openssl rsa decryption before nginx start
- Pipeline: install CA -> extract p12 -> get passphrase -> select config -> decrypt key -> start nginx
- Crash-early: encrypted key without SSL_KEY_PASSPHRASE exits entrypoint
- docker-compose.enterprise-clean.yml: add SSL_KEY_PASSPHRASE to frontend env
- .env.enterprise-clean.example: document SSL_KEY_PASSPHRASE usage
- build.sh: add SSL_KEY_PASSPHRASE to generated deploy compose

build.sh

@@ -286,6 +286,8 @@ services:
     restart: unless-stopped
     depends_on:
       - backend
+    environment:
+      SSL_KEY_PASSPHRASE: \${SSL_KEY_PASSPHRASE:-}
     ports:
       - "\${FRONTEND_HOST_PORT:-8000}:80"
       - "\${FRONTEND_SSL_PORT:-443}:443"