feat(ssl): add passphrase-protected key and PKCS#12 support in nginx entrypoint

- docker/frontend.entrypoint.sh: add 3 new functions:
  - extract_p12_if_needed — openssl pkcs12 extraction to .crt+.key
  - resolve_ssl_passphrase — read SSL_KEY_PASSPHRASE env var
  - decrypt_key_if_needed — openssl rsa decryption before nginx start
- Pipeline: install CA -> extract p12 -> get passphrase -> select config -> decrypt key -> start nginx
- Crash-early: encrypted key without SSL_KEY_PASSPHRASE exits entrypoint
- docker-compose.enterprise-clean.yml: add SSL_KEY_PASSPHRASE to frontend env
- .env.enterprise-clean.example: document SSL_KEY_PASSPHRASE usage
- build.sh: add SSL_KEY_PASSPHRASE to generated deploy compose

docker-compose.enterprise-clean.yml

@@ -77,6 +77,10 @@ services:
     restart: unless-stopped
     depends_on:
       - backend
+    environment:
+      # Пароль от приватного ключа/PKCS#12 для SSL терминации nginx.
+      # Опционально: если server.key не зашифрован или используется HTTP — не требуется.
+      SSL_KEY_PASSPHRASE: ${SSL_KEY_PASSPHRASE:-}
     ports:
       - "${FRONTEND_HOST_PORT:-8000}:80"
       # Если в CERTS_PATH есть server.crt + server.key — nginx включит HTTPS на 443.