feat: add LLM SSL verify control and auto CA cert download

- LLM_SSL_VERIFY env var to disable SSL verification for corporate proxies
- install_llm_ca_certs() entrypoint function — downloads PEM/DER certs
  from LLM_CA_CERT_URLS, converts DER→PEM, installs to system CA store
- _format_connection_error() — detailed exception chain logging
- 7 new unit tests for _get_ssl_verify, _format_connection_error, verify= param
- LLM_CA_CERT_URLS and LLM_SSL_VERIFY in .env.enterprise-clean
- Removed duplicate @RELATION DEPENDS_ON -> [EXT:Library:tenacity]

docker-compose.enterprise-clean.yml

@@ -48,6 +48,8 @@ services:
       FEATURES__HEALTH_MONITOR: ${FEATURES__HEALTH_MONITOR:-true}
       # Путь до сертификатов внутри контейнера — всегда /opt/certs
       CERTS_PATH: /opt/certs
+      # URL CA-сертификатов для LLM-провайдеров (скачка на старте, DER→PEM конвертация)
+      LLM_CA_CERT_URLS: ${LLM_CA_CERT_URLS:-}
     ports:
       - "${BACKEND_HOST_PORT:-8001}:8000"
     volumes: