Ship setup_cert.py to repo root, auto-fetch all CA materials

Closes #2.

Previously the cert minting script lived in local-tools/ (gitignored)
and the README pointed at a cert-only source that didn't include the
private key or upstream chain.

setup_cert.py now lives at the repo root and live-fetches both the
peer UUID (from the relevant TLS server cert subject DN) and the
full AC14K_M + upstream chain bundle (RemoteAccessCA + CECA + ROOTCA)
from a public mirror. Each fetch has an inline workaround if the
network is restricted (UUID=..., AC14K_M_CERT_BUNDLE=...,
BRAYSTORM_URL=...). Modulus-pair check catches a wrong-key mistake
before signing. bootstrap.py removed -- imported a package that was
renamed in commit 709fdf4.

Output files use neutral client.* names. README, .env.example,
docker-compose.yml, deploy.sh, and config.py updated to match.

Provenance receipts in local-tools/cert_provenance.md.

.env.example

@@ -27,10 +27,9 @@ APPLIANCE_1_NAME=Samsung Dryer
 
 # --- Cert paths ---
 # Defaults work for Docker (mount as /config) and bare-metal (drop
-# into ./certs). The ab0b0ac4 admin-override cert + key are built by
-# local-tools/setup_samsung_cloud_cert.py.
-# CERT_PATH=./certs/ab0b0ac4_fullchain.pem
-# KEY_PATH=./certs/ab0b0ac4.key
+# into ./certs). The client cert + key are built by setup_cert.py.
+# CERT_PATH=./certs/client_fullchain.pem
+# KEY_PATH=./certs/client.key
 
 # --- MQTT broker (HA Mosquitto add-on or any broker) ---
 MQTT_BROKER=192.168.1.5