Add Certificate Decode tool for public X.509 certificates

[rksk]

Summary

• Adds a new "Certificate Decode" tool (Encode/Decode category) that parses public X.509 certificates entirely client-side
• Accepts pasted PEM/Base64 DER text, an uploaded file, or drag-and-drop of a binary .cer/.crt/.der file
• Uses a hand-rolled ASN.1/DER reader (no libraries, consistent with the rest of the toolkit) to extract subject, issuer, validity (with a valid/expired banner like the JWT tool), serial number, signature/public-key algorithm (RSA + EC with curve detection), key size, SHA-1/SHA-256 fingerprints, and extensions (SAN, key usage, extended key usage, basic constraints/CA flag)
• Only ever parses public certificate fields — no private key material is accepted or processed

Test plan

• Verified parsed fields (subject, issuer, validity, serial, key size, SAN, basic constraints) against openssl x509 -text output for both RSA and EC test certificates
• Verified SHA-256 fingerprint matches openssl x509 -noout -fingerprint -sha256
• Verified binary DER file round-trips byte-for-byte through the upload path before parsing
• Manual smoke test in browser (paste, upload, drag-and-drop, clear-on-edit behavior)